topic Re: Log Collection and forward to SPLUNK in Getting Data In

Log Collection and forward to SPLUNK

BLRINGLER — Wed, 27 Dec 2017 21:08:13 GMT

Hello

I have a request to have a SYSLOG server and a SPLUNK server. The request is to have the logs from external sources written to the SYSLOG server then forwarded and read by the SPLUNK server.

I searched and read an old post

https://answers.splunk.com/answers/28680/universal-forwarder-vs-dedicated-rsyslog-syslog-ng-servers-to-forward-syslog-to-splunk-indexer.html

I am using MS Server 2012 R2 for both, SPLUNK Enterprise 7

How would I:

Have logs from different sources (Cisco, Microsoft, Linux) written to a SYSLOG Server.
Forward the log to a SPLUNK server

Thanks

Re: Log Collection and forward to SPLUNK

petercow — Wed, 27 Dec 2017 23:53:01 GMT

1) configure the sources to have your server be their logging destination (each kind of device does that differently, but the result is the same).

2) install a Splunk Universal forwarder on that box, to monitor the syslog file being generated from step 1.

Re: Log Collection and forward to SPLUNK

BLRINGLER — Thu, 28 Dec 2017 10:04:23 GMT

Thanks

1) The logging destination is the SYSLOG Server?

2) Install the Splunk Universal Forwarder on the SYSLOG server to forward to the SPLUNK Server?

So the logs go to one server and the actual Splunk reports on another server? Or everything should be on one server

Thanks,

Re: Log Collection and forward to SPLUNK

petercow — Thu, 28 Dec 2017 14:19:19 GMT

1) yes
2) Yes - see below
3) You can have the syslog server also be the splunk server (in which case you don't need the forwarder), but for reasons of scalability, etc., I would have them be 2 separate servers.

Re: Log Collection and forward to SPLUNK

BLRINGLER — Thu, 28 Dec 2017 14:35:30 GMT

Thank you

The scalability was the main factor

Thanks Again