Getting Data In

Getting syslog data into splunk lightweight forwarder

ultra
Explorer

Hi, I'm new to splunk, so my question might be lame. I am trying to setup a splunk lightweight forwarder, my problem is the following. If it is a lightweight forwarder, it cannot be a listener. How do I get data into lightweight forwarder in first place (I have syslog-ng running on the same box, and I want LWF to load balance the data across several indexers)?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The best way to do this is to just have Splunk monitor the files/directories where syslog-ng is writing (and rotating) log files. The reason for this is that the files can provide a buffer for capturing data for when the forwarder can't receive data (e.g., if the network is down and the queue fills up, or the forwarder is restarted, or a temporarily high input data rate such that the indexer backs up, etc.). For this, then you don't need to enable the network inputs. You can just create a file monitor input using the CLI or configuration file.

You can re-enable UDP inputs on a LWF by creating a local default-mode.conf file containing the entry:

[pipeline:udp]
disabled =false

but I think that capturing the data with syslog, syslog-ng, or rsyslog is better because of the buffering it provides.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...