Forward data to HF

[novotxms]

I have a UF installed on syslog server and now I want the data to come to HF and not to go to UF. I just need the syslog data to be completely redirected to HF from UF. What are the config changes that I need to do?

[gcusello]

Hi @novotxms,

let me understand: are you asking help on how to configure the syslog source or what else?

If this is your need, it depends on the the source appliance: you have to go in the management interface and change the syslog destination IP.

Obviously, remember to configure the HF to receive syslogs on a predefined port and protocol.

Ciao.

Giuseppe

[novotxms]

I do not have access to syslog server. 

I just have access to HF and not even to splunk indexer which is the UF. Yes I am asking help on the configuration changes that I should do

[gcusello]

Hi @novotxms,

sorry, but there's something that I don't understand:

• you have one or more applicances that are sending syslogs to a syslog server (syslog-ng probably);
• on this server you installed an UF that reads the file written by the syslog-ng;
• UF sends logs to an indexer;
• now you want to receive syslogs on an HF instead of the UF;

Is it correct?

It's not clear for me when you say: "splunk indexer which is the UF", Indexer and UF usually are two different systems!

Anyway, if you want to receive syslogs on the HF instead of the UF, you have to do the following steps:

• install Splunk on HF (it's a full Splunk installation where logs are forwarded to one or more Indexers);
• configure it to send logs to Indexers [Settings -- Forward and Receive Data -- Forward Data];
• enter in the management console of your appliances and modify the syslog destination (I cannot help you about this because it depends on the appliance);
• configure on HF the receiving  on the same port/protocol of the appliance [Settings -- inputs -- Network Inputs];
• check on Indexers if you're indexing logs.

Ciao.

Giuseppe

[novotxms]

This helped me.. Thanks a lot for your help

[gcusello]

Hi @novotxms,

if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉