Getting Data In

Log Collection and forward to SPLUNK

BLRINGLER
Explorer

Hello

I have a request to have a SYSLOG server and a SPLUNK server. The request is to have the logs from external sources written to the SYSLOG server then forwarded and read by the SPLUNK server.

I searched and read an old post

https://answers.splunk.com/answers/28680/universal-forwarder-vs-dedicated-rsyslog-syslog-ng-servers-...

I am using MS Server 2012 R2 for both, SPLUNK Enterprise 7

How would I:

  1. Have logs from different sources (Cisco, Microsoft, Linux) written to a SYSLOG Server.

  2. Forward the log to a SPLUNK server

Thanks

Tags (3)
0 Karma
1 Solution

petercow
Path Finder

1) yes
2) Yes - see below
3) You can have the syslog server also be the splunk server (in which case you don't need the forwarder), but for reasons of scalability, etc., I would have them be 2 separate servers.

View solution in original post

0 Karma

petercow
Path Finder

1) yes
2) Yes - see below
3) You can have the syslog server also be the splunk server (in which case you don't need the forwarder), but for reasons of scalability, etc., I would have them be 2 separate servers.

0 Karma

BLRINGLER
Explorer

Thank you

The scalability was the main factor

Thanks Again

petercow
Path Finder

1) configure the sources to have your server be their logging destination (each kind of device does that differently, but the result is the same).

2) install a Splunk Universal forwarder on that box, to monitor the syslog file being generated from step 1.

0 Karma

BLRINGLER
Explorer

Thanks

1) The logging destination is the SYSLOG Server?

2) Install the Splunk Universal Forwarder on the SYSLOG server to forward to the SPLUNK Server?

So the logs go to one server and the actual Splunk reports on another server? Or everything should be on one server

Thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...