topic Re: Urgent Help required , Splunk Indexer to forward data to syslog server(rsyslog or thrid party) in Getting Data In

Urgent Help required , Splunk Indexer to forward data to syslog server(rsyslog or thrid party)

sumitkathpal292 — Fri, 17 Nov 2017 08:36:25 GMT

Dear Experts,

Currently we have test environment where we have one indexer and search head however we need to forward the syslog data(On port 514) received from the indexer to another syslog server and also keep local copy for our search head for investigation/log retention purpose.

Thanks in advance

Re: Urgent Help required , Splunk Indexer to forward data to syslog server(rsyslog or thrid party)

koshyk — Fri, 17 Nov 2017 11:36:50 GMT

how are you receiving the data? You use Search Head as your heavy-forwarder to send to Indexder?
Or do you want to send the data from Indexer to syslog server?

Re: Urgent Help required , Splunk Indexer to forward data to syslog server(rsyslog or thrid party)

skalliger — Fri, 17 Nov 2017 14:20:44 GMT

Hi,

Edit: I just realised - according to the documentation - only Heavy Forwarders are able to output syslog data. You still may try it.

simply add an outputs.conf on your indexer with something like this:

[syslog]
defaultGroup=YourSyslogServerGroup

[syslog:YourSyslogServerGroup]
server = 1.2.3.4:514

This should do the job. For further details, review the documentation.

Skalli