Getting Data In

Can Heavy Forwarder write syslog data locally ?

dm1
Contributor

I have configured Heavy Forwarder to collect and forward syslog data to our Splunk Indexers. We purposely don't wish to use syslog server for the log collection due to other reasons.

Now we also have a requirement to forward the syslog data to Azure log analytics. Unfortunately, with log analytics, we must use log analytics agent (which is very similar to Splunk UF) to collect logs locally on the HF and forward to log analytics. I haven't found a way to forward logs from HF to log analytics directly. 

Hence, just wondering if someone can advise if its possible to configure HF to write logs locally, just exactly how syslog does (like rsyslog) ?

Labels (1)
Tags (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

No. You can only use outputs listed on https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Outputsconf

So if your have a very strong need to pass the date by your forwarder first and write it to local file afterwards, you'd have to use local syslog daemon and forward the data to it.

So you'd be better off doing it the other way around after all - collecting data with local syslog and forwarding it to splunk forwarder - it's more obvious this way.

View solution in original post

0 Karma

venky1544
Builder

Hi @dm1 

I Don't Think you can configure it in HF as an alternate you can call the rest api . you could write a local powershell script or use curl with crontab to export the data via rest api into a file and then use the log analytics agent to read that file 

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No. You can only use outputs listed on https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Outputsconf

So if your have a very strong need to pass the date by your forwarder first and write it to local file afterwards, you'd have to use local syslog daemon and forward the data to it.

So you'd be better off doing it the other way around after all - collecting data with local syslog and forwarding it to splunk forwarder - it's more obvious this way.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...