topic Using Splunk universal forwarder to forward log into Kiwi Syslog Server in Getting Data In

Using Splunk universal forwarder to forward log into Kiwi Syslog Server

ailing1909 — Tue, 05 Dec 2017 07:01:51 GMT

Is there any ways for me to forward log into Kiwi Syslog Server by using Splunk universal forwarder?

Re: Using Splunk universal forwarder to forward log into Kiwi Syslog Server

lycollicott — Tue, 05 Dec 2017 14:14:13 GMT

First of all, why on earth would you want to do that? Send it to Splunk instead.

Re: Using Splunk universal forwarder to forward log into Kiwi Syslog Server

harsmarvania57 — Tue, 05 Dec 2017 14:33:49 GMT

Hi @ailing1909,

From Universal Forwarder you can route data to TCP server without filtering raw data but not UDP. If your syslog can accept data on TCP port and you do not want to filter raw data then you can configure UF outputs.conf to send data to Syslog server, please refer https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Forwarddatatothird-partysystemsd#TCP_data

If you want to send data from UF to Syslog server over UDP then you need to use Heavy Forwarder, you can't achieve it via UF.

I hope this helps.

Thanks,
Harshil

Re: Using Splunk universal forwarder to forward log into Kiwi Syslog Server

ailing1909 — Wed, 06 Dec 2017 00:50:12 GMT

thanks for the help 🙂

Re: Using Splunk universal forwarder to forward log into Kiwi Syslog Server

ailing1909 — Thu, 07 Dec 2017 02:04:11 GMT

hi! is there other way that i can do so? as i configure UF output.conf file, however i still didn't manage to send through

Re: Using Splunk universal forwarder to forward log into Kiwi Syslog Server

harsmarvania57 — Thu, 07 Dec 2017 03:34:12 GMT

Can you please let us know how you configured on UF and in which configuration files?

Re: Using Splunk universal forwarder to forward log into Kiwi Syslog Server

ailing1909 — Thu, 07 Dec 2017 03:45:23 GMT

i config in UF output.conf under UF\etc\system\local\output.conf this what i did

[tcpout]
server = 192.168.1.113:9997
sendCookedData = false
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 192.168.1.113:9997

[tcpout-server://192.168.1.113:9997]

Re: Using Splunk universal forwarder to forward log into Kiwi Syslog Server

harsmarvania57 — Thu, 07 Dec 2017 04:20:27 GMT

Config which you have provided it looks like UF to Indexer configuration.

If you want to send all data from UF to Syslog server over TCP only then please use below configuration in outputs.conf

[tcpout]
defaultGroup = syslog_group

[tcpout:fastlane]
server = <SYSLOG IP>:<SYSLOG TCP PORT>
sendCookedData = false

If you want to send data to Indexer and Syslog server over TCP then you can use below configuration

[tcpout]
defaultGroup = indexer_group, syslog_group

[tcpout:indexer_group]
server = <IDX IP>:<IDX PORT>

[tcpout:syslog_group]
server = <SYSLOG IP>:<SYSLOG TCP PORT>
sendCookedData = false