https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-to-3rd-Party-Systems-as-Syslog/m-p/71034#M14444 <P><A href="http://splunk-base.splunk.com/answers/13856/how-do-i-configure-the-universal-forwarder-to-send-uncooked-data">See here</A></P> <P>I have no idea if the uncooked data is in a syslog friendly format though.</P> <P><EM>Update</EM></P> <P>The uncooked data is syslog friendly. </P> <P>sample outputs.conf :</P> <PRE><CODE>[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = splunkindex:514 sendCookedData=false [tcpout-server://splunkindex:514] </CODE></PRE> <P>It does send the universal forwarder logs too though, which could be messy ( and most of the events are multiline which syslog sees as multiple events )</P> <P>All things considered, it might be easier to use <A href="http://www.intersectalliance.com/snareagents/index.html">snare</A></P> Fri, 21 Dec 2012 17:56:31 GMT jonuwz 2012-12-21T17:56:31Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-to-3rd-Party-Systems-as-Syslog/m-p/71033#M14443 <P>I've read that the Universal Forwarded is not able to forward messages to a Syslog server. <BR /> Although this <A href="http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Typesofforwarders">TABLE</A> says that it is possible to forward to 3rd party systems. <BR /><BR /> Could anyone clear this issue for me? <BR /><BR /> I would like to forward log entries from a Windows Eventlog Collector to a Syslog Server using splunk forwarders. </P> Fri, 21 Dec 2012 16:56:07 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-to-3rd-Party-Systems-as-Syslog/m-p/71033#M14443 FRoth 2012-12-21T16:56:07Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-to-3rd-Party-Systems-as-Syslog/m-p/71034#M14444 <P><A href="http://splunk-base.splunk.com/answers/13856/how-do-i-configure-the-universal-forwarder-to-send-uncooked-data">See here</A></P> <P>I have no idea if the uncooked data is in a syslog friendly format though.</P> <P><EM>Update</EM></P> <P>The uncooked data is syslog friendly. </P> <P>sample outputs.conf :</P> <PRE><CODE>[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = splunkindex:514 sendCookedData=false [tcpout-server://splunkindex:514] </CODE></PRE> <P>It does send the universal forwarder logs too though, which could be messy ( and most of the events are multiline which syslog sees as multiple events )</P> <P>All things considered, it might be easier to use <A href="http://www.intersectalliance.com/snareagents/index.html">snare</A></P> Fri, 21 Dec 2012 17:56:31 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-to-3rd-Party-Systems-as-Syslog/m-p/71034#M14444 jonuwz 2012-12-21T17:56:31Z