Splunk Search

Splunk Standalone forward data to syslog

mpuchalski
Observer

We have a relatively small Splunk implementation - just 1 standalone server. We're downloading Cisco Umbrella logs from the Cisco-managed S3 Bucket for reporting purposes.

We now have the need to also forward those umbrella logs to a syslog server in addition to leaving them on the standalone for reporting. Is there a way to configure a standalone to forward to a syslog server?

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mpuchalski,

Please read this https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Sysl... it can be configured on any Splunk instance. Just a word of caution: if you configure forwarding to a third party receiver and the receiving end goes down or is not available you will get in trouble on your Splunk instance.

Hope this helps ...

cheers, MuS

0 Karma

mpuchalski
Observer

With this standalone instance, I have multiple apps receiving data.  I only want 1 index to fwd to an external syslog server.  Is that possible without a heavy forwarder?

0 Karma

mpuchalski
Observer

Thank you. What is the trouble that Splunk will experience is the receiver is not available?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...