topic Re: Why collect Syslog via universal forwarder vs sending to Splunk directly? in Getting Data In

Why collect Syslog via universal forwarder vs sending to Splunk directly?

tfaria — Thu, 19 Oct 2017 09:35:22 GMT

Hi all,

I've been reading quite a bit on syslog collection via a Splunk Universal Forwarder. In particular answer #28680.https://answers.splunk.com/answers/28680/index.html I understand the reasons behind using SUF or another syslog collector as opposed to sending to Splunk directly. I haven't, however, been able to figure out how to perform an approach such as:

syslog device (rsyslog - linux client) -> SUF -> Splunk

Can someone point me in the right direction?

I apologize if this question has been answered before, but my google-fu isn't helping me.

Thank you.

Re: Why collect Syslog via universal forwarder vs sending to Splunk directly?

richgalloway — Thu, 19 Oct 2017 13:01:59 GMT

Your devices send syslog events to the rsyslog server. Rsyslog writes the events to disk. SUF monitors said disk file(s) and forwards the events to Splunk. Does that help?

Re: Why collect Syslog via universal forwarder vs sending to Splunk directly?

tfaria — Thu, 19 Oct 2017 13:29:18 GMT

I see. Makes sense. I was under the impression SUF could act as sort of a relay, and I would be able to just point to it. That being said, is there a sample config (inputs/outouts.conf) for SUF on how to deal locally stored rsyslog files?

Re: Why collect Syslog via universal forwarder vs sending to Splunk directly?

skoelpin — Thu, 19 Oct 2017 13:43:12 GMT

Try this, but make sure to change the monitor path to point to your log file location, change the index and sourcetype

inputs.conf

[monitor:///opt/log/www*/access.log]
index=web
sourcetype=access_combined

outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
disabled = false
server = Indexer1:9997,Indexer2:9997