How can i integrate Workspace one logs into Splunk?

[Abhirup89]

Can someone guide me on ingestion of Workspace one logs into splunk

[iamarkaprabha · Accepted solution]

Hi ,

Yes , Usually Workspace one hosted in VM Ware. They generated syslogs , you can use syslog forwarder at workspace side and forward those logs into splunk HF then index it using TA.

[gregz00]

Splunk HFW seems the best way to get this done.

But, has anyone figured out a way to use HEC Endpoint?

[sheamus69]

What specific TA are you referring to?

[rnishimoto]

@sheamus69 I am also trying to ingest WorkspaceOne logs into Splunk. Were you able to find a specific TA that worked for this purpose?

[rajashaey]

Hi,

Anyone figured out the way to integrate please?