topic Re: How to forward from HF to a RFC5424 syslog target in Getting Data In

How to forward from HF to a RFC5424 syslog target

MattKr — Mon, 16 Sep 2024 14:49:54 GMT

Good day,
I'm trying to setup the HF to forward to an additional syslog target which expects the RFC5424 (Grafana Alloy) so far the HF is reaching the syslog target but then the target complains about missing priority and I'm not sure if this because of the RFC5424 vs RFC3164

I've tried the following outputs.conf option:

[syslog:my_syslog_group] disabled = false server = grafana-alloy.svc.cluster.local:51898 type = tcp #other tested variant priority = <NO_PRI> priority = <34> #tested with or without timeformat timestampformat = %b %e %H:%M:%S

How can i make sure that the HF syslog forward is using the RFC5424 format?

Re: How to forward from HF to a RFC5424 syslog target

PickleRick — Mon, 16 Sep 2024 18:25:12 GMT

How are you getting the original data? Splunk has many great features but it's not a fully-blown syslog receiver/processor. If you're receiving them using syslog as well it would probably be better to use rsyslog/syslog-ng to receive the event and forward it from there (and send another copy to Splunk over HEC)

Re: How to forward from HF to a RFC5424 syslog target

dural_yyz — Mon, 16 Sep 2024 19:08:43 GMT

The documentation for outputs.conf.spec specifically mentions RFC3164 so I don't believe Splunk has the configuration to support RFC5424 the way you want.

Honestly I would look at a packet capture at the destination from a good source and a relayed via Splunk HF to confirm. However, I wouldn't get your hopes up that Splunk will relay the way you want.

Re: How to forward from HF to a RFC5424 syslog target

MattKr — Mon, 16 Sep 2024 21:48:31 GMT

inputs.conf is used for the incoming data.

It's the chain: inputs, props and transforms to syslog described here

It would be great to transform to RFC5424 this way but i doubt it's possible or is it?

Re: How to forward from HF to a RFC5424 syslog target

PickleRick — Tue, 17 Sep 2024 07:09:09 GMT

Of course you're using inputs.conf. Without it you'd have no inputs. Question is what inputs you get your data from. Is it a simple tcp:// or udp:// input and you're receiving data directly on your indexer (which you shouldn't)? Is it an intermediate syslog daemon writing to files which are read by UF? Is it something else?