Getting Data In

Export to Syslog

Explorer

Hi All,

Does anyone know if it's possible to take logs that have been grabbed from Windows WMI and indexed, and then forward them on to a syslog server?

This is a requirement here that needs to be met before the Admins will consider the program... needless to say it's causing me some grief so I thought I'd put it out here and see if any guru's can point me in the right direction...

Cheers,

DB

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Sure. You can have Splunk forward on anything it indexes via syslog format. Generally, you configure the indexers to forward on syslog, not the forwarders. The thing to note is that Splunk's Windows Event Logs will have internal newline characters. It shouldn't cause any problems with receiving syslog agents, depending what they do with it though. I would nevertheless have you test it against your preferred receiver to see if you like the results.

http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems#Forward_syslog...

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Sure. You can have Splunk forward on anything it indexes via syslog format. Generally, you configure the indexers to forward on syslog, not the forwarders. The thing to note is that Splunk's Windows Event Logs will have internal newline characters. It shouldn't cause any problems with receiving syslog agents, depending what they do with it though. I would nevertheless have you test it against your preferred receiver to see if you like the results.

http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems#Forward_syslog...

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!