Getting Data In

Does the Greylog deployment forward events to the indexer or the forwarder?

pfabrizi
Path Finder

I just found out that we need to allow our Greylog deployment to forward events to SPLUNK. It looks like Greylog has an app that does that and can filter, send tcp or udp but what it didn't mention was does it forward to indexer or to a forwarder?

Does anyone have any information on this or familiar with this?

We will have a 10 node single-site cluster, 3 SH cluster and ES, HF and 3 UF, deployment\licsense master, cluster master and health monitor.

Thanks!

0 Karma

xpac
SplunkTrust
SplunkTrust

Hey,
I just checked the docs you are likely refering too.
They just use a common Splunk TCP input, which could be configured on every Splunk instance, although you usually don't do this kind of thing on an indexer, but on a UF or HF.

Actually, the cleanest solution for this is usually have your source (in this case greylog) write it's data to a file, and then have Splunk read that file. If you ever restart that Splunk instance or it is for any other reason unavailable, you'll most likely loose the data that would be sent during that outage. With a file, Splunk will just catch up from where it stopped before a restart.

Hope that helps!

0 Karma

pfabrizi
Path Finder

I am guessing that if I wanted to write directly to the indexer from Greylog it would need a certificate from the indexer?

0 Karma

xpac
SplunkTrust
SplunkTrust

TCP inputs are unencrypted by default, so no, you won't 😉

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...