topic Re: Splunk as a syslog server in Getting Data In

Splunk as a syslog server

stevetaylormnp — Wed, 13 Feb 2013 11:10:59 GMT

Can Splunk be used as a syslog server receiving syslog messages directly from a firewall or is a separate syslog server required?

Re: Splunk as a syslog server

MuS — Wed, 13 Feb 2013 11:18:01 GMT

hi stevetaylormnp

Yes, it can. see examples here

Update: working link is here http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

But keep in mind, if you setup a single splunk indexer to receive syslog, your syslog data is lost while you restart your splunk.

cheers,

muS

Re: Splunk as a syslog server

jeff — Wed, 13 Feb 2013 12:35:22 GMT

It can, but the best practice is to use a dedicated syslog receiver and have splunk index the individual log files. See the answer at http://splunk-base.splunk.com/answers/28680

Re: Splunk as a syslog server

stefanlasiewski — Tue, 29 Oct 2013 17:16:56 GMT

What do you mean by "your syslog data is lost while you restart your Splunk"? Splunk stores syslog input inside of files along with all of it's other data-- it won't lose the data due to a simple restart.

Re: Splunk as a syslog server

MuS — Wed, 30 Oct 2013 07:26:48 GMT

I'm not talking about the already indexed syslog data. If you setup Splunk to receive syslog data and reboot / restart your Splunk server, who will then receive those syslog packets? Correct, no one will = data lost in UDP space.......
To prevent such things you could setup a syslog-ng server as master syslog collector, save everything into a file and use a universal forwarder to read and sent this file to the indexer.

hope this makes more sense now. Cheers , MuS

Re: Splunk as a syslog server

season88481 — Mon, 01 Aug 2016 09:32:58 GMT

Ops, this page doesn't exist...:-)

Re: Splunk as a syslog server

MuS — Mon, 01 Aug 2016 20:23:14 GMT

updated 😉