Getting Data In
Highlighted

Configuring forwarding from splunk to an external syslog server

New Member

Hello,

What is the recommended method of forwarding all splunk inputs to an external syslog server listening on UDP/514?

Our setup in question is a Full Splunk 6.0 implementation and has multiple data inputs listening on multiple ports (514-520) logging data into multiple Source Types and Indexes.

I am looking for the recommended configuration within Splunk to forward all that data (no filtering required) to an external syslog server (SIEMC).

Thanks!!

0 Karma
Highlighted

Re: Configuring forwarding from splunk to an external syslog server

Contributor

Check out this Answers topic: Output syslog to external
Here is the relevant section of the documentation: Forward data to third party systems -- Syslog data

Highlighted

Re: Configuring forwarding from splunk to an external syslog server

Explorer

If no filtering is require, you can just edit outputs.conf:

Edit outputs.conf to specify receiving host/IP and port
[syslog:mytargetgrp]
type = tcp (Optional)
server = 192.168.0.1:514

0 Karma