All Apps and Add-ons

Help on onboarding data

blbr123
Path Finder

Hi All,

How to onboard Tandem XMA data to splunk?

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @blbr123,

I didn't used Tandem XMA before, but in general, you have to understand how Tandem XMA can send its logs (e.g. syslog or Forwarders) and then configure Splunk to receive them.

Reading here (https://xypro.com/secure-database-management/from-zero-to-hero-integrate-hpe-nonstop-with-splunk/) it seems that you can configure Tandem XMA to send syslogs using TCP or UDP protocol, so you have to:

  • check the firewall routes between tandem XMS devices and Splunk,
  • configure Splunk syslog receiving [Settings -- Inputs -- Network Inputs -- New] or eventually using "Splunk Connect for syslog" App (https://splunkbase.splunk.com/app/4740/),
  • configure Tamdem XMA to send logs to the Splunk server.

If you didn't configured Splunk syslog receiving before, you can see the following videos and documents:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/Data/HowSplunkEnterprisehandlessyslogdata

https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html

https://www.youtube.com/watch?v=iJ1iBZdXt2o

https://www.youtube.com/watch?v=BQU-bsSCXhk

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @blbr123,

I didn't used Tandem XMA before, but in general, you have to understand how Tandem XMA can send its logs (e.g. syslog or Forwarders) and then configure Splunk to receive them.

Reading here (https://xypro.com/secure-database-management/from-zero-to-hero-integrate-hpe-nonstop-with-splunk/) it seems that you can configure Tandem XMA to send syslogs using TCP or UDP protocol, so you have to:

  • check the firewall routes between tandem XMS devices and Splunk,
  • configure Splunk syslog receiving [Settings -- Inputs -- Network Inputs -- New] or eventually using "Splunk Connect for syslog" App (https://splunkbase.splunk.com/app/4740/),
  • configure Tamdem XMA to send logs to the Splunk server.

If you didn't configured Splunk syslog receiving before, you can see the following videos and documents:

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/Data/HowSplunkEnterprisehandlessyslogdata

https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html

https://www.youtube.com/watch?v=iJ1iBZdXt2o

https://www.youtube.com/watch?v=BQU-bsSCXhk

Ciao.

Giuseppe

0 Karma

blbr123
Path Finder

@gcusello Thank you for the response, Actually I already went through the link and was looking to see if there is any additional information available on this.

So looks like I have to onboard it using SC4S only as it's a syslog data.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @blbr123,

syslog isn't the most efficient way to take logs, but it's one of the most used and easier to configure.

Try it and let me know.

Remember that you can ingest syslogs only runtime, this means that, if you need to be sure to take all the logs, you have to configure an High Avalilability architecture: in few words, you need at least two Splunk servers (called Heavy Forwarders) with a Load balancer to take the syslogs.

Ciao.

Giuseppe

0 Karma

blbr123
Path Finder

@gcusello sure will check the possibilities and try and let you know.

Thank you.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @blbr123,

good for you, let me know and see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...