topic Re: How to send audit.log to external system? in Getting Data In

How to send audit.log to external system?

ClausBom — Thu, 19 Feb 2015 10:23:58 GMT

Hi guys,

In order to comply with auditor demands, we need to send the audit.log files from (Linux-based) indexers and search heads to an external system (not Splunk).

Is there any way, we can get Splunk itself to send these files to e.g. syslog, or do we have to find another way to do it?

I have read http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd and http://answers.splunk.com/answers/116701/how-to-send-audit-and-splunkd-logs-of-splunk-instance-to-external-syslog-server.html but still not found the silver bullet 😕

Regards
Claus

Re: How to send audit.log to external system?

LukeMurphey — Fri, 20 Feb 2015 07:14:33 GMT

outputs.conf is likely the right approach. For example, you could use something like this:

inputs.conf

[monitor://$SPLUNK_HOME/var/log/splunk/audit.log*]
_SYSLOG_ROUTING = syslog-output

outputs.conf

[syslog]
defaultGroup = syslog-output

[syslog:syslog-output]
disabled = false
# Define your syslog server here
server = 1.2.3.4:514
# This assumes you are using TCP, which is recommended
type = tcp

You can also forward data by index.

Re: How to send audit.log to external system?

aanataliya — Tue, 05 Jun 2018 11:28:54 GMT

Hi @LukeMurphey,

How do we forward Splunk Cloud's log. We are using Splunk cloud without Deployment server and we do not have access to CLI. How do I forwarder Splunk Cloud's audit log to external system?