Configuring forwarding from splunk to an external syslog server

[jmunroe]

Hello,

What is the recommended method of forwarding all splunk inputs to an external syslog server listening on UDP/514?

Our setup in question is a Full Splunk 6.0 implementation and has multiple data inputs listening on multiple ports (514-520) logging data into multiple Source Types and Indexes.

I am looking for the recommended configuration within Splunk to forward all that data (no filtering required) to an external syslog server (SIEMC).

Thanks!!

[psow_splunk]

If no filtering is require, you can just edit outputs.conf:

Edit outputs.conf to specify receiving host/IP and port
[syslog:my_target_grp]
type = tcp (Optional)
server = 192.168.0.1:514

[matt]

Check out this Answers topic: Output syslog to external
Here is the relevant section of the documentation: Forward data to third party systems -- Syslog data