Archive

Urgent Help required , Splunk Indexer to forward data to syslog server(rsyslog or thrid party)

New Member

Dear Experts,

Currently we have test environment where we have one indexer and search head however we need to forward the syslog data(On port 514) received from the indexer to another syslog server and also keep local copy for our search head for investigation/log retention purpose.

Thanks in advance

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

Edit: I just realised - according to the documentation - only Heavy Forwarders are able to output syslog data. You still may try it.

simply add an outputs.conf on your indexer with something like this:

[syslog]
defaultGroup=YourSyslogServerGroup

[syslog:YourSyslogServerGroup]
server = 1.2.3.4:514

This should do the job. For further details, review the documentation.

Skalli

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi,

Edit: I just realised - according to the documentation - only Heavy Forwarders are able to output syslog data. You still may try it.

simply add an outputs.conf on your indexer with something like this:

[syslog]
defaultGroup=YourSyslogServerGroup

[syslog:YourSyslogServerGroup]
server = 1.2.3.4:514

This should do the job. For further details, review the documentation.

Skalli

View solution in original post

0 Karma

Super Champion

how are you receiving the data? You use Search Head as your heavy-forwarder to send to Indexder?
Or do you want to send the data from Indexer to syslog server?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!