topic Using Splunk as a log forwarder itself? in Getting Data In

Using Splunk as a log forwarder itself?

gjones4 — Mon, 17 Jun 2013 17:55:33 GMT

I'm looking at Splunk to possibly replace a Kiwi Syslog server, however I don't see one of the features that Kiwi provides for us in Splunk. Logs collected in our Kiwi server are also forwarded to another server for alerting and whatnot. Can I use Splunk to collect syslogs, then in turn forward those collected logs to another appliance?

Re: Using Splunk as a log forwarder itself?

yannK — Mon, 17 Jun 2013 18:11:12 GMT

Universal forwarders can collect syslog data,
but only heavy forwarders and indexers (using the splunk core installer) can forward syslog data.

see http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/Forwarddatatothird-partysystemsd#Syslog_data

Re: Using Splunk as a log forwarder itself?

gjones4 — Mon, 17 Jun 2013 18:43:39 GMT

so, just for claification:

I set up my Splunk server to receive syslog data from my various devices, but then also configure it as a "heavy forwarder" to send that collected data to a 3rd party device?