Getting Data In

Can I send cisco syslog messages to a universal forwarder and make it send logs to an indexer?

NimaBokhar
Path Finder

hi
I am already a basic user of splunk to monitor our networking equipment syslogs now I want to install universal forwarder in each branch to collect data when the network goes down and data can't be sent to the splunk server I wanted to know can I send cisco syslog messages to a universal forwarder and make it send logs to indexer? and what would happen when the link between the branch and data center goes down? how can I cache logs to send them after links are up and running again?

0 Karma
1 Solution

FrankVl
Ultra Champion

Best practice is to collect syslog data using a syslog daemon like rsyslog or syslog-ng, which writes the logs to files (e.g. into separate folders split by source device hostname) and then use a Splunk UF to monitor those files. One of the reasons for this approach being recommended is exactly what you are after: buffering. The syslog daemon will keep writing to the files, even if the UF can no longer forward the data to the indexers. The UF will continue once connection has been restored.

Check also some of the excellent sessions from last year's ,conf event that present several tips and tricks on this topic: http://conf.splunk.com/sessions/2017-sessions.html#search=syslog&

View solution in original post

FrankVl
Ultra Champion

Best practice is to collect syslog data using a syslog daemon like rsyslog or syslog-ng, which writes the logs to files (e.g. into separate folders split by source device hostname) and then use a Splunk UF to monitor those files. One of the reasons for this approach being recommended is exactly what you are after: buffering. The syslog daemon will keep writing to the files, even if the UF can no longer forward the data to the indexers. The UF will continue once connection has been restored.

Check also some of the excellent sessions from last year's ,conf event that present several tips and tricks on this topic: http://conf.splunk.com/sessions/2017-sessions.html#search=syslog&

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...