Does Splunk support capturing data from CA Layer7 and how?

[Phranquelyn]

Layer7 was acquired by CA and is offered as an API Management Platform. It seems that Layer7 should be able to send log data to a Syslog server and have a Splunk forwarder capture and send to the Splunk indexer. Does anyone have any further details about support for this?

[cafissimo]

Hello,
I managed to install splunk universal forwarder 6.3.0 on Layer7 appliances and to send Layer7 "api logs" to Splunk indexers.
There is nothing special to configure on Layer7 appliances.

[dimitryz]

Hello,
CA not exactly supports installing universal forwarder on their appliance.
But it always possible to set a syslog on CA API Gateway and point it to Heavy Forwarder or Indexer - depending on your configuration.

Syslog is set by using Log Sink Properties :setting type as syslog and setting splunk host:port in syslog settings.
Important :
You have to set at least one category - Audit ,for example and at least one additional filter - for example Service Name .
Splunk setting are pretty standard - TCP Data input (UDP is also supported by Layer 7 ) ,port (for example 514) ,source type(syslog or any proper source type) host and index.