Getting Data In

Can Splunk write the data it receives to raw syslog files?

Builder

Hi,

I know, this sounds backwards. However, this is a requirement for a migration process from a syslog-ng/custom java report builder based system to Splunk. The first step is forwarding the logs to their current report builder using Splunk if possible, the following step will be to replicate their reports in Splunk itself.

Basically I have lightforwarders consuming the application logs already, and would like to use these to forward the data to their reporting server to, hopefully a heavy forwarder, to write log files to the filesystem in raw standard syslog format. Their reports should be able to read these as if nothing has changed.

Is this possible?

Cheers,

Glenn

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Splunk can't directly write to raw logfiles. But you can forward to a syslog-ng to do the writing for you. http://www.splunk.com/base/Documentation/latest/Deploy/Forwarddatatothird-partysystemsd

View solution in original post

SplunkTrust
SplunkTrust

Splunk can't directly write to raw logfiles. But you can forward to a syslog-ng to do the writing for you. http://www.splunk.com/base/Documentation/latest/Deploy/Forwarddatatothird-partysystemsd

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!