Getting Data In

Can Heavy Forwarder write syslog data locally ?

dm1
Contributor

I have configured Heavy Forwarder to collect and forward syslog data to our Splunk Indexers. We purposely don't wish to use syslog server for the log collection due to other reasons.

Now we also have a requirement to forward the syslog data to Azure log analytics. Unfortunately, with log analytics, we must use log analytics agent (which is very similar to Splunk UF) to collect logs locally on the HF and forward to log analytics. I haven't found a way to forward logs from HF to log analytics directly. 

Hence, just wondering if someone can advise if its possible to configure HF to write logs locally, just exactly how syslog does (like rsyslog) ?

Labels (1)
Tags (2)
0 Karma
1 Solution

PickleRick
Ultra Champion

No. You can only use outputs listed on https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Outputsconf

So if your have a very strong need to pass the date by your forwarder first and write it to local file afterwards, you'd have to use local syslog daemon and forward the data to it.

So you'd be better off doing it the other way around after all - collecting data with local syslog and forwarding it to splunk forwarder - it's more obvious this way.

View solution in original post

0 Karma

venky1544
Contributor

Hi @dm1 

I Don't Think you can configure it in HF as an alternate you can call the rest api . you could write a local powershell script or use curl with crontab to export the data via rest api into a file and then use the log analytics agent to read that file 

 

 

0 Karma

PickleRick
Ultra Champion

No. You can only use outputs listed on https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Outputsconf

So if your have a very strong need to pass the date by your forwarder first and write it to local file afterwards, you'd have to use local syslog daemon and forward the data to it.

So you'd be better off doing it the other way around after all - collecting data with local syslog and forwarding it to splunk forwarder - it's more obvious this way.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...