https://community.splunk.com/t5/Getting-Data-In/Can-Splunk-write-the-data-it-receives-to-raw-syslog-files/m-p/18179#M2456 <P>Hi,</P> <P>I know, this sounds backwards. However, this is a requirement for a migration process from a syslog-ng/custom java report builder based system to Splunk. The first step is forwarding the logs to their current report builder using Splunk if possible, the following step will be to replicate their reports in Splunk itself.</P> <P>Basically I have lightforwarders consuming the application logs already, and would like to use these to forward the data to their reporting server to, hopefully a heavy forwarder, to write log files to the filesystem in raw standard syslog format. Their reports should be able to read these as if nothing has changed.</P> <P>Is this possible?</P> <P>Cheers,</P> <P>Glenn</P> Fri, 27 May 2011 10:29:56 GMT Glenn 2011-05-27T10:29:56Z https://community.splunk.com/t5/Getting-Data-In/Can-Splunk-write-the-data-it-receives-to-raw-syslog-files/m-p/18179#M2456 <P>Hi,</P> <P>I know, this sounds backwards. However, this is a requirement for a migration process from a syslog-ng/custom java report builder based system to Splunk. The first step is forwarding the logs to their current report builder using Splunk if possible, the following step will be to replicate their reports in Splunk itself.</P> <P>Basically I have lightforwarders consuming the application logs already, and would like to use these to forward the data to their reporting server to, hopefully a heavy forwarder, to write log files to the filesystem in raw standard syslog format. Their reports should be able to read these as if nothing has changed.</P> <P>Is this possible?</P> <P>Cheers,</P> <P>Glenn</P> Fri, 27 May 2011 10:29:56 GMT https://community.splunk.com/t5/Getting-Data-In/Can-Splunk-write-the-data-it-receives-to-raw-syslog-files/m-p/18179#M2456 Glenn 2011-05-27T10:29:56Z https://community.splunk.com/t5/Getting-Data-In/Can-Splunk-write-the-data-it-receives-to-raw-syslog-files/m-p/18180#M2457 <P>Splunk can't directly write to raw logfiles. But you can forward to a syslog-ng to do the writing for you. <A href="http://www.splunk.com/base/Documentation/latest/Deploy/Forwarddatatothird-partysystemsd">http://www.splunk.com/base/Documentation/latest/Deploy/Forwarddatatothird-partysystemsd</A></P> Fri, 27 May 2011 15:11:50 GMT https://community.splunk.com/t5/Getting-Data-In/Can-Splunk-write-the-data-it-receives-to-raw-syslog-files/m-p/18180#M2457 dwaddle 2011-05-27T15:11:50Z