How to connect Heroku and Splunk (not storm!)

[ripper234]

I found this article about hooking up Heroku to Splunk Storm.

We are not using Splunk Storm, but rather a standalone installation of Splunk (4.3.2). How do I connect it to Heroku logs?

[himynamesdave]

Update: for anyone running 6+ you can install this app https://apps.splunk.com/app/1873/ (also contains full instructions of how to ingest Heroku syslog drains for any Splunk version)

[gkanapathy · Accepted solution]

You should be able to do something similar (but simpler) on the splunk side by creating a Splunk syslog (or UDP) listener port, and using the same method as described on the Heroku side to send the data there instead. Of course you will have to deal with your own firewalls and security (which is what the extra steps in Storm address). I don't know if there are other options to get data out of Heroku, but if the syslog/UDP one works with Storm, it will work with Splunk on-premise.

[ripper234]

Works like a charm - you can add a source right from the web UI. I used a TCP source and it worked.

[ripper234]

Any documentation on how to do what you just described?

[gkanapathy]

It appears the Heroku output is a TCP syslog stream, so I think you should be able to use the TCP rather than UDP input.