topic Re: Forward data to HF in Alerting

Forward data to HF

novotxms — Mon, 29 Mar 2021 11:07:57 GMT

I have a UF installed on syslog server and now I want the data to come to HF and not to go to UF. I just need the syslog data to be completely redirected to HF from UF. What are the config changes that I need to do?

Re: Forward data to HF

gcusello — Mon, 29 Mar 2021 11:12:45 GMT

Hi @novotxms,

let me understand: are you asking help on how to configure the syslog source or what else?

If this is your need, it depends on the the source appliance: you have to go in the management interface and change the syslog destination IP.

Obviously, remember to configure the HF to receive syslogs on a predefined port and protocol.

Ciao.

Giuseppe

Re: Forward data to HF

novotxms — Mon, 29 Mar 2021 11:21:38 GMT

I do not have access to syslog server.

I just have access to HF and not even to splunk indexer which is the UF. Yes I am asking help on the configuration changes that I should do

Re: Forward data to HF

gcusello — Mon, 29 Mar 2021 12:25:38 GMT

Hi @novotxms,

sorry, but there's something that I don't understand:

you have one or more applicances that are sending syslogs to a syslog server (syslog-ng probably);
on this server you installed an UF that reads the file written by the syslog-ng;
UF sends logs to an indexer;
now you want to receive syslogs on an HF instead of the UF;

Is it correct?

It's not clear for me when you say: "splunk indexer which is the UF", Indexer and UF usually are two different systems!

Anyway, if you want to receive syslogs on the HF instead of the UF, you have to do the following steps:

install Splunk on HF (it's a full Splunk installation where logs are forwarded to one or more Indexers);
configure it to send logs to Indexers [Settings -- Forward and Receive Data -- Forward Data];
enter in the management console of your appliances and modify the syslog destination (I cannot help you about this because it depends on the appliance);
configure on HF the receiving on the same port/protocol of the appliance [Settings -- inputs -- Network Inputs];
check on Indexers if you're indexing logs.

Ciao.

Giuseppe

Re: Forward data to HF

novotxms — Tue, 30 Mar 2021 06:14:31 GMT

This helped me.. Thanks a lot for your help

Re: Forward data to HF

gcusello — Tue, 30 Mar 2021 06:43:08 GMT

Hi @novotxms,

if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉