Getting Data In

Can I configure a universal forwarder to send syslog messages to a syslog server?

manuram
New Member

Could some one help me out here..

Can I configure a Universal forwarder to send the syslog messages to a (non splunk) syslog server?

Right now I have Universal forwarder which is sending data to a Splunk Indexer. Can I configure the same forwarder to send the data to another system (no splunk) as syslog messages?

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

According to the Docs, you need to use a Heavy Forwader to use Syslog Routing:

Syslog data
You can configure a heavy forwarder to send data in standard syslog format. The forwarder sends the data through a separate output processor. You can also filter the data with props.conf and transforms.conf. You'll need to specify _SYSLOG_ROUTING as the DEST_KEY.

Doc link:
http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Forwarddatatothird-partysystemsd#Syslog...

manuram
New Member

Could some one help me on this..

Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...