topic Re: forward Splunk logs to syslog server in Getting Data In

forward Splunk logs to syslog server

pil321 — Sat, 08 Feb 2014 15:55:33 GMT

I have an unusual requirement from my client. To satisfy log retention policies (among other things) I need to send Splunk logs (from the indexer) to a syslog server (RHEL - rsyslog). I have seen many guides on how to send rsyslog files to Splunk, but haven't found anything so far on how to forward logs from Splunk to syslog. I'm only looking to send certain logs, which makes this ideal since Splunk will index what I need to send. I know that this is possible, just need to see an example.

Re: forward Splunk logs to syslog server

martin_mueller — Sat, 08 Feb 2014 16:04:42 GMT

You're probably looking for this: http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd#Send_a_subset_of_data_to_a_syslog_server

Re: forward Splunk logs to syslog server

pil321 — Sat, 08 Feb 2014 16:28:26 GMT

The example shows how to do this from a heavy forwarder. Do you know if it would be possible from an indexer?

Re: forward Splunk logs to syslog server

martin_mueller — Sat, 08 Feb 2014 16:39:38 GMT

A heavy forwarder and an indexer are based on the same set of features, so anything one can do can be done by the other as well.

Take a look at the IndexAndForward section in here http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Outputsconf along with the Syslog section.

I don't have a fully functioning example to post, so far retention within Splunk was sufficient for everyone.

Re: forward Splunk logs to syslog server

pil321 — Sat, 08 Feb 2014 16:55:19 GMT

Great! Thanks for the help - again!