topic Re: Syslog from switch to indexer in Getting Data In

Syslog from switch to indexer

chrisitanmoleck — Thu, 19 Apr 2018 07:04:40 GMT

Hello,

we want to send syslog from cisco switches directly to the splunk indexer.
So I made a NAT from UDP 514 to 5447 and a new UPD data input (for 5447).

Is it also neccessary to define these data at the inputs.conf of the indexer?

Best Regards
Christian

Re: Syslog from switch to indexer

p_gurav — Thu, 19 Apr 2018 07:15:35 GMT

You can refer below doc:

http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/HowSplunkEnterprisehandlessyslogdata
http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Monitornetworkports

Re: Syslog from switch to indexer

mayurr98 — Thu, 19 Apr 2018 07:17:27 GMT

I think you would need to configure inputs.conf for port 5447 at the indexer.

go to /opt/splunk/bin/ on indexer and run this command.

     ./splunk add udp 5447 -sourcetype syslog

Refer this doc for more
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Monitornetworkports#Examples

let me know if this helps!

Re: Syslog from switch to indexer

chrisitanmoleck — Thu, 19 Apr 2018 11:46:28 GMT

Unfortunately it doesn't work.

IP-Tables NAT: /usr/sbin/iptables -t nat -A PREROUTING -m udp -p udp --dport 514 -j REDIRECT --to-ports 5447
Firewall entries for 5447 and 514

Entry in $SPLUNK_HOME/etc/system/local/inputs.conf

[udp://10.23.112.64:5447]
disabled = false
sourcetype = syslog
index = switches

This creates a new data input.

I struggeling with your command, because the splunk running user has some security protection, so that I can't execute it.

In metrics.log I have some of these entries:

04-19-2018 13:43:59.762 +0200 INFO  Metrics - group=udpin_connections, 10.23.112.64:5447, sourcePort=5447, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00

Otherwise I can't find any data in splunk to the switch.

Re: Syslog from switch to indexer

starcher — Fri, 20 Apr 2018 03:22:42 GMT

Though you can syslog to indexers. Don’t. Send to a syslog server of your flavor and use a universal forwarder to pickup logs.

http://www.georgestarcher.com/splunk-success-with-syslog/

Re: Syslog from switch to indexer

chrisitanmoleck — Tue, 24 Apr 2018 08:11:15 GMT

I found the solution:

Port forwarding was not enabled for the interface. 1
The NAT-Rule was not saved. 2