topic Re: Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Should-I-create-one-syslog-server-and-configure-all-the-syslog/m-p/388199#M69549 <P>On purpose or not, you ended up doing the best practice for that kind of use case. <span class="lia-unicode-emoji" title=":winking_face:">😉</span><BR /> Syslog server writing to disk and Splunk monitoring those files is the recommended approach.</P> Thu, 10 May 2018 22:47:36 GMT xpac 2018-05-10T22:47:36Z Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server? https://community.splunk.com/t5/Getting-Data-In/Should-I-create-one-syslog-server-and-configure-all-the-syslog/m-p/388197#M69547 <P>We have different syslog sources.<BR /> Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server and then install the UF to read the files from that paths?</P> <P>Please share some scenarios or Splunk configuration.</P> Thu, 10 May 2018 17:55:02 GMT https://community.splunk.com/t5/Getting-Data-In/Should-I-create-one-syslog-server-and-configure-all-the-syslog/m-p/388197#M69547 rashid47010 2018-05-10T17:55:02Z Re: Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server? https://community.splunk.com/t5/Getting-Data-In/Should-I-create-one-syslog-server-and-configure-all-the-syslog/m-p/388198#M69548 <P>What you outlined is exactly what we ended up doing in each of our data centers. Kiwi Syslog on a virtual machine with a UF pulling in each log with the correct sourcetype. Our corporate IT guys ended up using Rsyslog on a Redhat VM with a UF as well. Both ended up being cheap, cost effective solutions to our syslog problem. </P> Thu, 10 May 2018 18:33:34 GMT https://community.splunk.com/t5/Getting-Data-In/Should-I-create-one-syslog-server-and-configure-all-the-syslog/m-p/388198#M69548 rgreer 2018-05-10T18:33:34Z Re: Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server? https://community.splunk.com/t5/Getting-Data-In/Should-I-create-one-syslog-server-and-configure-all-the-syslog/m-p/388199#M69549 <P>On purpose or not, you ended up doing the best practice for that kind of use case. <span class="lia-unicode-emoji" title=":winking_face:">😉</span><BR /> Syslog server writing to disk and Splunk monitoring those files is the recommended approach.</P> Thu, 10 May 2018 22:47:36 GMT https://community.splunk.com/t5/Getting-Data-In/Should-I-create-one-syslog-server-and-configure-all-the-syslog/m-p/388199#M69549 xpac 2018-05-10T22:47:36Z