Can I send cisco syslog messages to a universal forwarder and make it send logs to an indexer?

[NimaBokhar]

hi
I am already a basic user of splunk to monitor our networking equipment syslogs now I want to install universal forwarder in each branch to collect data when the network goes down and data can't be sent to the splunk server I wanted to know can I send cisco syslog messages to a universal forwarder and make it send logs to indexer? and what would happen when the link between the branch and data center goes down? how can I cache logs to send them after links are up and running again?

[FrankVl · Accepted solution]

Best practice is to collect syslog data using a syslog daemon like rsyslog or syslog-ng, which writes the logs to files (e.g. into separate folders split by source device hostname) and then use a Splunk UF to monitor those files. One of the reasons for this approach being recommended is exactly what you are after: buffering. The syslog daemon will keep writing to the files, even if the UF can no longer forward the data to the indexers. The UF will continue once connection has been restored.

Check also some of the excellent sessions from last year's ,conf event that present several tips and tricks on this topic: http://conf.splunk.com/sessions/2017-sessions.html#search=syslog&