Getting Data In

How do I get Splunk to listen to data over RELP?


For quite a while, I've been attempting to make an identical deployment of a Splunk Enterprise instance.
The original one I have is working just fine, however I've tried multiple ways to get the same data from the original deployment into the new deployment, with little success. (Someone previously suggested that I copy the entire SPLUNK_HOME folder to the new machine, however I'm aiming to set the new one up from scratch)

I've singled the issue out to an issue with RELP.
We're currently using Splunk to index syslog messages from network devices - these are then sent from an rsyslog server via RELP to the Splunk server.
These messages are being received fine on the current Splunk Server, but not the new one I've been attempting to set up. I have edited the necessary configurations on rsyslog to tell it to send data to the new Splunk server, however it is doesn't seem to be receiving anything.
For the record, when I configured rsyslog to send the data to the new machine over TCP, Splunk was receiving it fine, however I am required to get it working over RELP.

Would anyone know what I need to do to get the data through via RELP? I think it's something to do with the Splunk server side however I am not 100% sure.
Thanks in advance for your help.


To the best of my knowledge, Splunk does not support RELP. This is (as I'm sure you know) an rsyslog specific protocol that, while documented thoroughly, has only a few implementations outside of rsyslog itself. I don't even know how you've gotten network devices to send using RELP, but that might have been easy 😉

0 Karma