Background
I tried to configure sending events to a syslog server. Here is my configurations
outputs.conf
[syslog:my_syslog]
server = 10.10.10.2:514
type = tcp
disabled = false
transforms.conf
[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog
props.conf
[sourcetype::access_common]
TRANSFORMS-route = send_to_syslog
My syslog server's syslog.conf
*.* /var/log/messages
I can simulate a TCP connection on port 514 to my syslog server. However, the events are just not coming in. Any advice?
Added Splunk heavy forwarder using:
splunk enable app SplunkForwarder
./splunk add forward-server mysyslog:514 -auth admin:changeme
thanks
I have managed to send events over to my syslog server. my outputs.conf
[syslog:my_syslog]
server = 10.10.10.2:514
type=tcp
sendCookedData=false
indexAndForward = 1
I have managed to send events over to my syslog server. my outputs.conf
[syslog:my_syslog]
server = 10.10.10.2:514
type=tcp
sendCookedData=false
indexAndForward = 1