topic Re: Network device logs in Getting Data In

Network device logs

jmrubio — Wed, 07 Feb 2024 18:32:07 GMT

Hello!

I wanted to ask what is the best way/configuration to get network device logs directly into splunk?

Thanks in advance!

Re: Network device logs

richgalloway — Wed, 07 Feb 2024 21:46:38 GMT

Best Practice is to not ingest device logs directly into Splunk. Any time Splunk restarts data sent by the devices during the downtime will be lost. The recommended approach is to send the logs (usually in syslog format) to a dedicated receiver (syslog-ng or Splunk Connect for Syslog (SC4S)) and forward them to Splunk from there.

Re: Network device logs

jmrubio — Wed, 07 Feb 2024 21:52:31 GMT

@richgalloway Is there any way to not have to use a separate syslog server?

Re: Network device logs

richgalloway — Wed, 07 Feb 2024 21:56:41 GMT

Yes, there is, but it's not considered a Best Practice.

Define a TCP input to read the logs from the selected port. See https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

Re: Network device logs

jmrubio — Wed, 07 Feb 2024 22:02:09 GMT

I will try this out. Thanks!