In syslog ng I didn’t want to read the data and store the data , how do you do that?
Here is an example of syslog-ng configuration that stores the data on disk for Splunk to read. You will need to manage the data's retention with something like logrotate.https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html
Here is an example that uses syslog-ng and HEC, where no data is stored on the syslog server.https://www.splunk.com/en_us/blog/tips-and-tricks/syslog-ng-and-hec-scalable-aggregated-data-collect...
You could also use the Splunk App for Syslog (SC4S)
https://splunkbase.splunk.com/app/4740/
https://splunk.github.io/splunk-connect-for-syslog/main/
