topic Sending Splunk Data to Syslog Server in Getting Data In

Sending Splunk Data to Syslog Server

balcv — Mon, 28 Sep 2020 15:11:23 GMT

I have Splunk receiving data from various sources, but I would like to be able to send that data on to another syslog collector. I have read that various documents on how this should be achieved and I have added the following to the outputs.conf

[syslog:my_syslog_group]
server = 192.168.1.1:514
type = udp

Yet the data is not getting sent to that collector. This new collector is actually running on the same host as Splunk, but is using the default syslog port of UDP/514 where as Splunk is using a different port.

Firewalls are not causing the problem as I have tested this with the firewalls disabled.

What else do I need to do to make this work?

Re: Sending Splunk Data to Syslog Server

Ayn — Mon, 04 Nov 2013 07:44:43 GMT

Is this a full-blown Splunk instance (indexer or likewise) or a Universal Forwarder?

Re: Sending Splunk Data to Syslog Server

sbaryakov — Mon, 04 Nov 2013 09:53:52 GMT

If you use a free license this feature is disabled. (I'm pretty sure but not 100%)

Re: Sending Splunk Data to Syslog Server

balcv — Mon, 04 Nov 2013 22:09:16 GMT

Thank you. Yes I have had to revert to the Free License so that explains it.

Re: Sending Splunk Data to Syslog Server

wyldkao — Thu, 17 Apr 2014 07:29:30 GMT

Hi
I have similar probelm , so I use non-license splunk(it should be as your mean ==>free license), whether I only send TCPData but could not send syslog , right ??

wyldkao