topic Networking with splunk- sending logs from personal router to AWS in Deployment Architecture

Networking with splunk- sending logs from personal router to AWS

navarone0161 — Mon, 27 Jun 2022 14:48:16 GMT

I'm trying to send logs from my personal router to AWS instance with Splunk capability . if there is a way i can do this from the cli needs help

Re: Networking with splunk

PickleRick — Sat, 25 Jun 2022 09:19:02 GMT

There are several possibilities from which most extreme and most discouraged is to send raw syslog over internet.

Depends on the source and your overall architecture.

Re: Networking with splunk

gcusello — Sat, 25 Jun 2022 10:00:14 GMT

Hi @navarone0161,

I'm fully agree with @PickleRick, it isn't a good idea to send raw logs on Internet and there are many ways to do this that depend on your architecture.

Have you other data sources that send logs to your AWS Splunk instance?

If yes, you should use an Heavy Forwarder as a concentrator to take the logs from all your syslog data source and concentrate the logs from other Universal Forwarder, then you can send all those logs to your Splunk instance on AWS.

So you can open as less as possible connections between your infrastructure and Interned, in addition in this way you're using an encrypted connection.

If instead you have syslogs form only one appliance, I continue to discourage to send raw logs on internet, and you should put a local instance of Splunk to receive logs and forward them to your Cloud Instance.

Ciao.

Giuseppe

Re: Networking with splunk

PickleRick — Sat, 25 Jun 2022 10:04:06 GMT

To receive syslogs a Universal Forwarder would suffice. But we don't even know if the "personal router" the OP mentioned does syslog. We assumed it does so because most network appliances do.

Re: Networking with splunk

navarone0161 — Sun, 26 Jun 2022 02:31:14 GMT

Can you please provide me with steps how to do this from a new spectrum router

Re: Networking with splunk

navarone0161 — Sun, 26 Jun 2022 02:33:26 GMT

its a one time class assignment i really need help

Re: Networking with splunk

navarone0161 — Sun, 26 Jun 2022 02:36:45 GMT

"you should use an Heavy Forwarder as a concentrator to take the logs from all your syslog data source and concentrate the logs from other Universal Forwarder, then you can send all those logs to your Splunk instance on AWS"

Can you help me with the steps please using a new gen spectrum router

Re: Networking with splunk

yeasuh — Mon, 27 Jun 2022 14:51:54 GMT

Hello navarone0161, Thank you for participating in the Splunk Community.

It could help our volunteer users to guide you if you provided more details on your assignment and where you are getting stuck.

Re: Networking with splunk

gcusello — Tue, 28 Jun 2022 06:26:48 GMT

Hi @navarone0161,

I don't know this kind of router, but anyway the first thing you need is a machine that works as an Heavy Forwarder, the the steps are the following:

on the HF, enable Forwarding to the address of the Indexers on AWS [Settings -- Forwarding and Receiving -- Forwarding],
on the HF, enable Network input in [Settings -- Input -- Network Input]
on the HF, add the requested information (protocol, port and eventually source IP]
on the router enable syslog sending using the IP address of the HF and protocol and port that you configured in the HF.

Ciao.

Giuseppe

Re: Networking with splunk

navarone0161 — Wed, 06 Jul 2022 01:58:11 GMT

Thanks your awesome

Re: Networking with splunk

gcusello — Wed, 06 Jul 2022 06:33:53 GMT

Hi @navarone0161,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Networking with splunk

navarone0161 — Sat, 09 Jul 2022 09:07:25 GMT

Re: Networking with splunk

navarone0161 — Sat, 09 Jul 2022 09:03:56 GMT

im using 8.2.6