Hello all,
I have 3 indexers in our setup and we would like to setup Fortigate to send logs to Splunk. what is the best way to set this up? the indexers are not clustered.
hello there,
in general, you can use one of 2 ways:
1. syslog server to collect the fortinet logs and install a Forwarder to monitor the syslog directories and
2. Heavy Forwarder listening on UDP to the fortinet firewall and sending the data to indexers
in both cases, you have 1 IP that fortinet will send data to, and from that point, data will be load balanced to the 3 Indexers
there are many many articles in this portal and in community regarding considerations on both options.
use your favorite search engine, try something like: "splunk forwarder vs. syslog"
hope it helps
hello there,
in general, you can use one of 2 ways:
1. syslog server to collect the fortinet logs and install a Forwarder to monitor the syslog directories and
2. Heavy Forwarder listening on UDP to the fortinet firewall and sending the data to indexers
in both cases, you have 1 IP that fortinet will send data to, and from that point, data will be load balanced to the 3 Indexers
there are many many articles in this portal and in community regarding considerations on both options.
use your favorite search engine, try something like: "splunk forwarder vs. syslog"
hope it helps
@lgrachek - Are you using any of the Fortigate apps or add-ons on Splunkbase? If yes, which one? Just want to make sure your post is tagged appropriately for better visibility. Thanks.
Fortinet Fortigate Add-on for Splunk version 1.4 and Fortinet FortiGate App for Splunk version 1.4 We also have FortinetAR version 1.0.0