https://community.splunk.com/t5/Getting-Data-In/Syslog-forwarding/m-p/702844#M116238 <P>Perhaps this answer will help: <A href="https://community.splunk.com/t5/Splunk-Enterprise/Having-Syslog-logs-into-SPLUNK/m-p/693546/highlight/true#M19778" target="_blank">https://community.splunk.com/t5/Splunk-Enterprise/Having-Syslog-logs-into-SPLUNK/m-p/693546/highlight/true#M19778</A></P> Sat, 26 Oct 2024 00:48:11 GMT richgalloway 2024-10-26T00:48:11Z https://community.splunk.com/t5/Getting-Data-In/Syslog-forwarding/m-p/702840#M116236 <P>I have an appliance that can only forward syslog via UDP. Is there a way for me to forward the udp syslog to a machine that has a Heavy Forwarder, or UF on it and have the forwarder relay the Syslog via TLS to the server running my Splunk Enterprise Instance?</P> Sat, 26 Oct 2024 07:29:47 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-forwarding/m-p/702840#M116236 new2splunk3 2024-10-26T07:29:47Z https://community.splunk.com/t5/Getting-Data-In/Syslog-forwarding/m-p/702844#M116238 <P>Perhaps this answer will help: <A href="https://community.splunk.com/t5/Splunk-Enterprise/Having-Syslog-logs-into-SPLUNK/m-p/693546/highlight/true#M19778" target="_blank">https://community.splunk.com/t5/Splunk-Enterprise/Having-Syslog-logs-into-SPLUNK/m-p/693546/highlight/true#M19778</A></P> Sat, 26 Oct 2024 00:48:11 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-forwarding/m-p/702844#M116238 richgalloway 2024-10-26T00:48:11Z https://community.splunk.com/t5/Getting-Data-In/Syslog-forwarding/m-p/702845#M116239 <P>Two things.</P><P>1. A Heavy Forwarder <EM>is</EM> a Splunk Enterprise instance. It's just doing forwarding.</P><P>2. If you can receive your UDP traffic at the forwarder why send it to another Splunk instance with syslog instead of native Splunk protocol?</P> Sat, 26 Oct 2024 07:28:48 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-forwarding/m-p/702845#M116239 PickleRick 2024-10-26T07:28:48Z