Getting Data In

How do I send logs from a SSL VPN device to Splunk Heavy Forwarder?

galagapp
Loves-to-Learn

I would like to configure a SSL VPN device to send the logs over to the Splunk Heavy Forwarder on udp/514. How do I configure it? Do I just point it to the Splunk Heavy Forwarder in the Juniper SSL Device configuration? Thanks.

0 Karma

chanfoli
Builder

Hello, provided the input is set up on your heavy forwarder, and it is forwarding to your indexer, you have pretty much answered your question in that your appliance should have a way to configure it's syslog target. If you need some guidance on getting the input set up, refer to these documents.

Splunk Web method:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/SyslogTCP

Splunk CLI method:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Monitornetworkports

0 Karma

galagapp
Loves-to-Learn

I have already setup the Splunk Heavy Forwarder to receive syslog inputs on udp/514. I was wondering abut the SSL VPN setup. Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...