topic Re: Send log file from switch/router directly to splunk in Getting Data In

How to send log file from switch/router directly to Splunk?

eholz1 — Tue, 05 Jul 2022 16:14:54 GMT

Hello Splunkers,

Is a splunk forwarder required to send data to splunk from a switch or router?

Can I configure the the device to send logs directly to the splunk like using port 514.

Like in a cisco config - "logging host", etc

Thanks

EWH

Re: Send log file from switch/router directly to splunk

smurf — Fri, 01 Jul 2022 20:28:37 GMT

Hi,

it is possible to send directly to Splunk. You can set up input in Splunk (it would need to be either some kind of forwarder or indexer) to listen on a port. You can define it in GUI or in inputs.conf and it would look something like this. You can ommit the host and have it listen for any connection on a port.

[tcp://syslog.corp.example.net:514]
sourcetype = cisco:ise
index = cisco

On the network device, you would enter the IP address of the Splunk instance and whatever port you specified and you start receiving the data.

Keep in mind that it would be better to use a syslog server for this. Because when you restart the ingesting Splunk instance, you could start losing data. If you have multiple devices that you want to set up like this I would look at the SC4S project: https://splunk.github.io/splunk-connect-for-syslog/main/

Re: Send log file from switch/router directly to splunk

eholz1 — Fri, 01 Jul 2022 21:16:46 GMT

gosh, why did I not think of that!! Been awhile since my splunk training!

thanks!!

eholz1

Re: Send log file from switch/router directly to splunk

PickleRick — Fri, 01 Jul 2022 21:40:50 GMT

One more thing. You can't run input on port 514 if you run splunk with ordinary user (non-root). And running splunk as root is not something you should do.

Re: Send log file from switch/router directly to splunk

jotne — Sun, 03 Jul 2022 15:49:40 GMT

To be more exact, you can not use any port below 1024 in Splunk if Splunk does not run as root user.

An you should NOT run Splunk as root. So have a look at my post here on how to install Splunk as non root user and use Rsyslog to get syslog data inn to Splunk.

https://forum.mikrotik.com/viewtopic.php?p=888802#p888802