topic Syslog Data Reaching Forwarder? in Getting Data In

Syslog Data Reaching Forwarder?

itsmevic — Tue, 12 Jan 2021 02:30:19 GMT

Hello, I need to check to see if Syslog data is reaching my forwarders. What would be the best query to use to check this?

Re: Syslog Data Reaching Forwarder?

gcusello — Tue, 12 Jan 2021 08:19:47 GMT

Hi @itsmevic,

you can run a simple search on the index where you store the logs that you ingest with that input from your syslog.

You can recognize them using the host field.

in other words:

index=your_index host=your_host

Ciao.

Giuseppe

Re: Syslog Data Reaching Forwarder?

General_Talos — Tue, 12 Jan 2021 08:42:23 GMT

As per my understanding for syslog server logs monitoring, you have to install a Splunk UF agent on syslog server and perform "file & folder monitoring" (to the logs which you want to onboard into Splunk).

Within input.conf you define logs details like

index = XYZ sourcetype= ABC

if your logs are reporting to Splunk, you can check it by

| tstats count where index=ZYX sourcetype=ABC by sourcetype _time |timechart sum(count) as count by sourcetype