topic Re: Can splunk read data from unix stream socket? in Getting Data In

Can splunk read data from unix stream socket?

gots — Tue, 10 Jul 2018 13:45:08 GMT

Is it possible to get data in splunk from unix stream socket?
Not tcp\udp socket, but socket like this - https://en.wikipedia.org/wiki/Berkeley_sockets

For example syslog-ng have this feature.

Re: Can splunk read data from unix stream socket?

brolo — Tue, 17 Jul 2018 05:04:28 GMT

Why not use syslog-ng as a go between?
See this link: httpss://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html

Re: Can splunk read data from unix stream socket?

felipesewaybric — Tue, 17 Jul 2018 16:16:22 GMT

try with syslog, check the https://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/ProtocolDetection

Re: Can splunk read data from unix stream socket?

vidhyaArumalla — Tue, 17 Jul 2018 16:40:18 GMT

I agree with @brolo

Re: Can splunk read data from unix stream socket?

sjodle — Tue, 17 Jul 2018 17:18:51 GMT

I also agree. Alternatively, you could write a Bash or Python scripted input that reads the socket to stdout.

Re: Can splunk read data from unix stream socket?

woodcock — Tue, 17 Jul 2018 20:26:23 GMT

I concur with the consensus; see these excellent 2 posts:

http://www.georgestarcher.com/splunk-success-with-syslog/
https://gitlab.com/rationalcyber/syslog-ng-configuration/wikis/home

Re: Can splunk read data from unix stream socket?

gots — Wed, 18 Jul 2018 06:46:14 GMT

I already done it with syslog-ng, but it seems that will be better do not create additional entities for simple task.

Python script also can help, but it is not ideal solution.

I had little hope that something miss in documentation.

Thank you all.

Re: Can splunk read data from unix stream socket?

woodcock — Wed, 18 Jul 2018 12:00:54 GMT

Splunk needs more tuning, upgrades and restarts than does syslog-ng so if you go directly to Splunk, without a buffer capability on the sending side, you will have far more data loss. You can update yslog-ng configurations with SIGHUP without a restart or data outage. You cannot do that with Splunk. Use syslog-ng.