https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-listen-to-data-over-RELP/m-p/315436#M59017 <P>To the best of my knowledge, Splunk does not support RELP. This is (as I'm sure you know) an rsyslog specific protocol that, while documented thoroughly, has only a few implementations outside of rsyslog itself. I don't even know how you've gotten network devices to send using RELP, but that might have been easy <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 23 Feb 2017 03:42:01 GMT dwaddle 2017-02-23T03:42:01Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-listen-to-data-over-RELP/m-p/315435#M59016 <P>For quite a while, I've been attempting to make an identical deployment of a Splunk Enterprise instance.<BR /> The original one I have is working just fine, however I've tried multiple ways to get the same data from the original deployment into the new deployment, with little success. (Someone previously suggested that I copy the entire SPLUNK_HOME folder to the new machine, however I'm aiming to set the new one up from scratch)</P> <P>I've singled the issue out to an issue with RELP.<BR /> We're currently using Splunk to index syslog messages from network devices - these are then sent from an rsyslog server via RELP to the Splunk server.<BR /> These messages are being received fine on the current Splunk Server, but not the new one I've been attempting to set up. I have edited the necessary configurations on rsyslog to tell it to send data to the new Splunk server, however it is doesn't seem to be receiving anything.<BR /> For the record, when I configured rsyslog to send the data to the new machine over TCP, Splunk was receiving it fine, however I am required to get it working over RELP.</P> <P>Would anyone know what I need to do to get the data through via RELP? I think it's something to do with the Splunk server side however I am not 100% sure.<BR /> Thanks in advance for your help.</P> Thu, 23 Feb 2017 01:24:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-listen-to-data-over-RELP/m-p/315435#M59016 remmerson 2017-02-23T01:24:07Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-listen-to-data-over-RELP/m-p/315436#M59017 <P>To the best of my knowledge, Splunk does not support RELP. This is (as I'm sure you know) an rsyslog specific protocol that, while documented thoroughly, has only a few implementations outside of rsyslog itself. I don't even know how you've gotten network devices to send using RELP, but that might have been easy <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 23 Feb 2017 03:42:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-Splunk-to-listen-to-data-over-RELP/m-p/315436#M59017 dwaddle 2017-02-23T03:42:01Z