Getting Data In

How do I send logs from a SSL VPN device to Splunk Heavy Forwarder?

New Member

I would like to configure a SSL VPN device to send the logs over to the Splunk Heavy Forwarder on udp/514. How do I configure it? Do I just point it to the Splunk Heavy Forwarder in the Juniper SSL Device configuration? Thanks.

0 Karma

Builder

Hello, provided the input is set up on your heavy forwarder, and it is forwarding to your indexer, you have pretty much answered your question in that your appliance should have a way to configure it's syslog target. If you need some guidance on getting the input set up, refer to these documents.

Splunk Web method:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/SyslogTCP

Splunk CLI method:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Monitornetworkports

0 Karma

New Member

I have already setup the Splunk Heavy Forwarder to receive syslog inputs on udp/514. I was wondering abut the SSL VPN setup. Thanks.

0 Karma