Getting Data In

Configuring forwarding from splunk to an external syslog server

jmunroe
New Member

Hello,

What is the recommended method of forwarding all splunk inputs to an external syslog server listening on UDP/514?

Our setup in question is a Full Splunk 6.0 implementation and has multiple data inputs listening on multiple ports (514-520) logging data into multiple Source Types and Indexes.

I am looking for the recommended configuration within Splunk to forward all that data (no filtering required) to an external syslog server (SIEMC).

Thanks!!

0 Karma

psow_splunk
Splunk Employee
Splunk Employee

If no filtering is require, you can just edit outputs.conf:

Edit outputs.conf to specify receiving host/IP and port
[syslog:my_target_grp]
type = tcp (Optional)
server = 192.168.0.1:514

0 Karma

matt
Splunk Employee
Splunk Employee

Check out this Answers topic: Output syslog to external
Here is the relevant section of the documentation: Forward data to third party systems -- Syslog data

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...