How to Forward Data from Splunk Enterprise to TCP Syslog Server?

[jamaluddin-k]

Hi,

I have a simple TCP syslog server in the same network where I have setup my Splunk Enterprise platform 9.10. I am trying to forward the data polled into Splunk Enterprise by Add-On apps to the TCP Syslog Server. But even after configuring it from settings> Forwarding and Receiving, I am getting error like connection Timed out.

Can anyone suggest what is being missed or needs to be looked into here.

Thank you

[jamaluddin-k]

Hi @gcusello ,

I see, That was a big gap on my end. But I also already had tried the Syslog Forwarding section on the URL you shared. I was not able to receive any data at the syslog server.

My output.conf file is as simple as below.

[syslog]
defaultGroup=syslogGroup

[syslog:syslogGroup]
server = 192.168.6.158:514

I initially felt that the syslog server configuration might have some issue or maybe network, but no I was able to send TCP message to the syslog server from the Splunk Enterprise VM Instance. Only the data from Splunk is not getting forwarded.

Both the Sysylog Server VM and Splunk Enterprise VM are in the same network.

Just curious, is the defaultGroup parameter got to do something here?

Thanks for your help.

[gcusello]

Hi @jamaluddin-k,

as you can see in the following question (https://community.splunk.com/t5/Getting-Data-In/send-a-subset-of-logs-via-syslog-to-a-Third-Party-an...) I had the same problem and I solved  adding in inputs.conf _TCP_ROUTING to all the sourcetypes and _SYSLOG_ROUTING to the three ones to send to syslog.

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @jamaluddin-k,

forwarding data from GUI is a feature to send logs to another Splunk instance not to a syslog server.

If you want to send logs to a syslog server, you have to follow the instructions at https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/Forwarddatatothird-partysystemsd#Syslo...

Ciao.

Giuseppe

[jamaluddin-k]

Thanks @gcusello 
I was able to fix the issue. Apart from the fact that 3rd part needs syslog forwarding as you mentioned, the issue was the default protocol. Splunk has it as UDP.

Thanks