There are around 400 servers, which are already forwarding required logs to IBM Qradar using rsyslog. Instead of installing universal forwarders in every server, I want to add one more forwarder (Splunk HWF) in rsyslog config in order to receive logs from every servers.
• What utility I need to install on log Collector
• Can I install this utility on HWF itself as load is very less on this server
• Where I will define index and sourcetype details in this case
Put UF on your rsyslog box and read the files you are already writing.
it is IBM log collector that we need to decommission. Kindly help with standard solution.
The standard solution is to run a syslog collector with a UF as stated. You could make a new one and redirect syslog there.
Can I install this utility on HWF itself as load is very less on this server ?
Where I will define index and sourcetype details in this case ?
You shouldn't run a heavy forwarder to pickup syslog. You should use a universal forwarder.
Configuration of either install can do it, however inputs and getting data in can be found at https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Getstartedwithgettingdatain
You may want to consult your splunk administrator or professional services if you have not used splunk at all before.