https://community.splunk.com/t5/Getting-Data-In/Trouble-forwarding-splunkd-log-output-to-syslog/m-p/473096#M81294 <P>To have a UF forward to syslog, check <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd</A></P> <P>Keep in mind that if a forwarder send to a splunk indexer AND to a syslog server. It will stop sending to both if one of them is not responding, not great for HA.</P> Thu, 14 Nov 2019 00:48:49 GMT yannK 2019-11-14T00:48:49Z https://community.splunk.com/t5/Getting-Data-In/Trouble-forwarding-splunkd-log-output-to-syslog/m-p/473095#M81293 <P>I must be missing something very simple here so bear with me.<BR /> I am running a Splunk universal forwarder instance, and I would like to forward its internal logs (e.g. splunkd.log) to my own Syslog server. </P> <P>I would like to do this for my own internal audit logging separate from the indexer that is connected to the forwarder. Is there any support for this? <BR /> I have tried to set up rsyslog to watch splunkd.log but there seem to be some inotify shenanigans going on and rsyslog fails to recognize that the log file is being updated.</P> Thu, 31 Oct 2019 20:00:06 GMT https://community.splunk.com/t5/Getting-Data-In/Trouble-forwarding-splunkd-log-output-to-syslog/m-p/473095#M81293 rdupuis 2019-10-31T20:00:06Z https://community.splunk.com/t5/Getting-Data-In/Trouble-forwarding-splunkd-log-output-to-syslog/m-p/473096#M81294 <P>To have a UF forward to syslog, check <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd</A></P> <P>Keep in mind that if a forwarder send to a splunk indexer AND to a syslog server. It will stop sending to both if one of them is not responding, not great for HA.</P> Thu, 14 Nov 2019 00:48:49 GMT https://community.splunk.com/t5/Getting-Data-In/Trouble-forwarding-splunkd-log-output-to-syslog/m-p/473096#M81294 yannK 2019-11-14T00:48:49Z