How do I send logs from a SSL VPN device to Splunk Heavy Forwarder?

[galagapp]

I would like to configure a SSL VPN device to send the logs over to the Splunk Heavy Forwarder on udp/514. How do I configure it? Do I just point it to the Splunk Heavy Forwarder in the Juniper SSL Device configuration? Thanks.

[chanfoli]

Hello, provided the input is set up on your heavy forwarder, and it is forwarding to your indexer, you have pretty much answered your question in that your appliance should have a way to configure it's syslog target. If you need some guidance on getting the input set up, refer to these documents.

Splunk Web method:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/SyslogTCP

Splunk CLI method:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Monitornetworkports

[galagapp]

I have already setup the Splunk Heavy Forwarder to receive syslog inputs on udp/514. I was wondering abut the SSL VPN setup. Thanks.