topic Pushing syslog to Splunk indexer in Getting Data In

Pushing syslog to Splunk indexer

rahul2gupta — Wed, 24 Nov 2021 07:29:38 GMT

Hi ,

A user is complaining that :

From hostname1, we are pushing the syslog to Splunk indexer server IP - 10.20.30.40 via Port 55XY,
can you please check if anything needs to be done from Splunk end to see the data in Splunk.

Can anyone please me on this.

Regards,

Rahul

Re: Pushing syslog to Splunk indexer

PickleRick — Wed, 24 Nov 2021 07:55:47 GMT

Don't push syslog directly to splunk indexer. At least not in production environment.

Use some intermediate syslog receiver (sc4s is quite popular for this, I myself am a huge fan of rsyslog) from which splunk ingests the data in other ways (HEC, files).

Re: Pushing syslog to Splunk indexer

rahul2gupta — Wed, 24 Nov 2021 09:11:07 GMT

Thanks @PickleRick for reply.

Use some intermediate syslog receiver (sc4s is quite popular for this, I myself am a huge fan of rsyslog) from which splunk ingests the data in other ways (HEC, files) -- How this can be achieved. Can you please provide us the step?

Regards,

Rahul

Re: Pushing syslog to Splunk indexer

PickleRick — Wed, 24 Nov 2021 12:05:51 GMT

https://lists.archive.carbon60.com/rsyslog/users/25542#25542

(that's general idea for rsyslog but if you've never used it before, it may not be that straightforward)

https://splunkbase.splunk.com/app/4740/