topic Re: Syslog vs TA apps to parse network traffic sourcetypes in Getting Data In

Syslog vs TA apps to parse network traffic sourcetypes

sdintino_splunk — Mon, 31 Aug 2020 22:45:38 GMT

We are trying to ingest some logs for events from different network appliances such as F5 load balancers. Can you please tell us whether we should be logging them to a syslog and ingesting them from there or if we should be collecting them with splunk listening on a UDP port?

Re: Syslog vs TA apps to parse network traffic sourcetypes

richgalloway — Tue, 01 Sep 2020 00:31:30 GMT

Best Practice is to NOT log UDP/TCP directly to Splunk. Doing so can lead to data loss. Syslog events should go to a syslog server.

Re: Syslog vs TA apps to parse network traffic sourcetypes

isoutamo — Tue, 01 Sep 2020 04:35:38 GMT

just like @richgalloway said. If you are logging UDP directly to splunk it’s not if you lost events, it’s how often and how much you will be lost them.

r. Ismo

Re: Syslog vs TA apps to parse network traffic sourcetypes

sdintino_splunk — Tue, 01 Sep 2020 14:00:16 GMT

Thank you @richgalloway and @isoutamo ! This confirms what I'd thought. Much appreciated!