topic Re: pfsense logs to splunk in Getting Data In

pfsense logs to splunk

Navaneedhan — Thu, 14 Mar 2024 22:51:20 GMT

I want to get pfsense logs to splunk to make some analysis.

I tired this method "https://www.jaycroos.com/splunk-to-monitor-pfsence-logs/" but it didn't work for me.

Now i want to try using Splunk universal forwarder, How can i install Splunk universal forwarder on my pfsense to get the logs to splunk ? Any guidance would be appreciated.

please let me know if there is other method, where i can get my pfsense logs to the splunk server.

Re: pfsense logs to splunk

isoutamo — Fri, 15 Mar 2024 21:27:31 GMT

if your pfsense is running a node where you could install UF, then just install it. Then you probably could use this https://splunkbase.splunk.com/app/1527 or otherwise add needed inputs.conf for collect log files.

If you cannot install UF then you probably can use syslog to send logs to your syslog collector and then send those to splunk with UF or other way e.g. use SC4S.

r. Ismo