https://community.splunk.com/t5/Getting-Data-In/Syslog-segregation-and-how-pasing-works-when-it-is-a-syslog/m-p/28316#M4826 <P>Is it possible to segregate the logs by redirecting everything to the routers via Syslog(other server Syslog to router log), then on the router(CentOS server) installing a light weight forwarder or a Heavy forwarder based on the load and bandwidth and get the logs to the Indexer. </P> <P>If it is possible, how to Parse the data based on Hosts?</P> Wed, 15 Jun 2011 11:13:59 GMT praburam 2011-06-15T11:13:59Z https://community.splunk.com/t5/Getting-Data-In/Syslog-segregation-and-how-pasing-works-when-it-is-a-syslog/m-p/28316#M4826 <P>Is it possible to segregate the logs by redirecting everything to the routers via Syslog(other server Syslog to router log), then on the router(CentOS server) installing a light weight forwarder or a Heavy forwarder based on the load and bandwidth and get the logs to the Indexer. </P> <P>If it is possible, how to Parse the data based on Hosts?</P> Wed, 15 Jun 2011 11:13:59 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-segregation-and-how-pasing-works-when-it-is-a-syslog/m-p/28316#M4826 praburam 2011-06-15T11:13:59Z https://community.splunk.com/t5/Getting-Data-In/Syslog-segregation-and-how-pasing-works-when-it-is-a-syslog/m-p/28317#M4827 <P>Actually the easiest is to filter host on the TCP or UDP directly in your inputs.conf,but make sure there is no inputs.conf for the port you will use (ie no <CODE>[udp://514]</CODE> or <CODE>[tcp://514]</CODE> stanza):</P> <PRE><CODE>[udp://10.1.7.230:514] sourcetype = my-sourcetype [udp://10.1.7.232:514] sourcetype = my-sourcetype </CODE></PRE> <P>OR</P> <PRE><CODE>[tcp://10.1.8.28:514] sourcetype = my-sourcetype2 [tcp://10.1.8.30:514] sourcetype = my-sourcetype2 </CODE></PRE> Wed, 15 Jun 2011 12:08:48 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-segregation-and-how-pasing-works-when-it-is-a-syslog/m-p/28317#M4827 MarioM 2011-06-15T12:08:48Z