Getting Data In

How do I get Splunk to listen to data over RELP?

remmerson
Engager

For quite a while, I've been attempting to make an identical deployment of a Splunk Enterprise instance.
The original one I have is working just fine, however I've tried multiple ways to get the same data from the original deployment into the new deployment, with little success. (Someone previously suggested that I copy the entire SPLUNK_HOME folder to the new machine, however I'm aiming to set the new one up from scratch)

I've singled the issue out to an issue with RELP.
We're currently using Splunk to index syslog messages from network devices - these are then sent from an rsyslog server via RELP to the Splunk server.
These messages are being received fine on the current Splunk Server, but not the new one I've been attempting to set up. I have edited the necessary configurations on rsyslog to tell it to send data to the new Splunk server, however it is doesn't seem to be receiving anything.
For the record, when I configured rsyslog to send the data to the new machine over TCP, Splunk was receiving it fine, however I am required to get it working over RELP.

Would anyone know what I need to do to get the data through via RELP? I think it's something to do with the Splunk server side however I am not 100% sure.
Thanks in advance for your help.

dwaddle
SplunkTrust
SplunkTrust

To the best of my knowledge, Splunk does not support RELP. This is (as I'm sure you know) an rsyslog specific protocol that, while documented thoroughly, has only a few implementations outside of rsyslog itself. I don't even know how you've gotten network devices to send using RELP, but that might have been easy 😉

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...