https://community.splunk.com/t5/Getting-Data-In/forward-to-syslog/m-p/319234#M59636 <P>I want to you splunk forwarder to send apache-logs to syslog</P> <P>i made config:</P> <P>/opt/splunkforwarder/etc/system/local</P> <P>inputs.conf <BR /> [default]<BR /> host = my_hostname</P> <P>outputs.conf <BR /> [syslog]<BR /> defaultGroup=syslogGroup</P> <P>[syslog:my_syslog_group]<BR /> server = IP:514</P> <P>props.conf <BR /> [host::cpanel*]<BR /> TRANSFORMS-cpanel = send_to_syslog</P> <P>[source::/usr/local/apache/domlogs/logfile]</P> <P>transforms.conf <BR /> [send_to_syslog]<BR /> REGEX = .<BR /> DEST_KEY = _SYSLOG_ROUTING<BR /> FORMAT = my_syslog_group</P> <P>i restart splunk<BR /> /opt/splunkforwarder/bin/splunk restart</P> <P>and nothing happened (it don't send any information)<BR /> and in logs, i can't see source files</P> Tue, 29 Sep 2020 17:44:48 GMT sigizmynd 2020-09-29T17:44:48Z https://community.splunk.com/t5/Getting-Data-In/forward-to-syslog/m-p/319234#M59636 <P>I want to you splunk forwarder to send apache-logs to syslog</P> <P>i made config:</P> <P>/opt/splunkforwarder/etc/system/local</P> <P>inputs.conf <BR /> [default]<BR /> host = my_hostname</P> <P>outputs.conf <BR /> [syslog]<BR /> defaultGroup=syslogGroup</P> <P>[syslog:my_syslog_group]<BR /> server = IP:514</P> <P>props.conf <BR /> [host::cpanel*]<BR /> TRANSFORMS-cpanel = send_to_syslog</P> <P>[source::/usr/local/apache/domlogs/logfile]</P> <P>transforms.conf <BR /> [send_to_syslog]<BR /> REGEX = .<BR /> DEST_KEY = _SYSLOG_ROUTING<BR /> FORMAT = my_syslog_group</P> <P>i restart splunk<BR /> /opt/splunkforwarder/bin/splunk restart</P> <P>and nothing happened (it don't send any information)<BR /> and in logs, i can't see source files</P> Tue, 29 Sep 2020 17:44:48 GMT https://community.splunk.com/t5/Getting-Data-In/forward-to-syslog/m-p/319234#M59636 sigizmynd 2020-09-29T17:44:48Z https://community.splunk.com/t5/Getting-Data-In/forward-to-syslog/m-p/319235#M59637 <P>Using Universal forwarders you can't send data to syslog server Reference <A href="https://docs.splunk.com/Documentation/Splunk/7.0.1/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data">doc</A>, you require splunk enterprise instance.</P> <PRE><CODE>You can configure a heavy forwarder to send data in standard syslog format. The forwarder sends the data through a separate output processor. The syslog output processor is not available for universal or light forwarders. </CODE></PRE> Fri, 19 Jan 2018 07:27:57 GMT https://community.splunk.com/t5/Getting-Data-In/forward-to-syslog/m-p/319235#M59637 harsmarvania57 2018-01-19T07:27:57Z