topic How do I send logs from a SSL VPN device to Splunk Heavy Forwarder? in Getting Data In

How do I send logs from a SSL VPN device to Splunk Heavy Forwarder?

galagapp — Tue, 10 Feb 2015 18:13:56 GMT

I would like to configure a SSL VPN device to send the logs over to the Splunk Heavy Forwarder on udp/514. How do I configure it? Do I just point it to the Splunk Heavy Forwarder in the Juniper SSL Device configuration? Thanks.

Re: How do I send logs from a SSL VPN device to Splunk Heavy Forwarder?

chanfoli — Tue, 10 Feb 2015 19:49:17 GMT

Hello, provided the input is set up on your heavy forwarder, and it is forwarding to your indexer, you have pretty much answered your question in that your appliance should have a way to configure it's syslog target. If you need some guidance on getting the input set up, refer to these documents.

Splunk Web method:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/SyslogTCP

Splunk CLI method:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Monitornetworkports

Re: How do I send logs from a SSL VPN device to Splunk Heavy Forwarder?

galagapp — Wed, 11 Feb 2015 20:19:56 GMT

I have already setup the Splunk Heavy Forwarder to receive syslog inputs on udp/514. I was wondering abut the SSL VPN setup. Thanks.