Can Heavy Forwarder write syslog data locally ?

[dm1]

I have configured Heavy Forwarder to collect and forward syslog data to our Splunk Indexers. We purposely don't wish to use syslog server for the log collection due to other reasons.

Now we also have a requirement to forward the syslog data to Azure log analytics. Unfortunately, with log analytics, we must use log analytics agent (which is very similar to Splunk UF) to collect logs locally on the HF and forward to log analytics. I haven't found a way to forward logs from HF to log analytics directly. 

Hence, just wondering if someone can advise if its possible to configure HF to write logs locally, just exactly how syslog does (like rsyslog) ?

[venky1544]

Hi @dm1 

I Don't Think you can configure it in HF as an alternate you can call the rest api . you could write a local powershell script or use curl with crontab to export the data via rest api into a file and then use the log analytics agent to read that file 

[PickleRick · Accepted solution]

No. You can only use outputs listed on https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Outputsconf

So if your have a very strong need to pass the date by your forwarder first and write it to local file afterwards, you'd have to use local syslog daemon and forward the data to it.

So you'd be better off doing it the other way around after all - collecting data with local syslog and forwarding it to splunk forwarder - it's more obvious this way.