Getting Data In

How to forward logs using rsyslog

asharma21193
New Member

There are around 400 servers, which are already forwarding required logs to IBM Qradar using rsyslog. Instead of installing universal forwarders in every server, I want to add one more forwarder (Splunk HWF) in rsyslog config in order to receive logs from every servers.

• What utility I need to install on log Collector
• Can I install this utility on HWF itself as load is very less on this server
• Where I will define index and sourcetype details in this case

0 Karma

starcher
SplunkTrust
SplunkTrust

Put UF on your rsyslog box and read the files you are already writing.

0 Karma

starcher
SplunkTrust
SplunkTrust
0 Karma

asharma21193
New Member

it is IBM log collector that we need to decommission. Kindly help with standard solution.

0 Karma

starcher
SplunkTrust
SplunkTrust

The standard solution is to run a syslog collector with a UF as stated. You could make a new one and redirect syslog there.

0 Karma

asharma21193
New Member

Can I install this utility on HWF itself as load is very less on this server ?
Where I will define index and sourcetype details in this case ?

0 Karma

starcher
SplunkTrust
SplunkTrust

You shouldn't run a heavy forwarder to pickup syslog. You should use a universal forwarder.

Configuration of either install can do it, however inputs and getting data in can be found at https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Getstartedwithgettingdatain

You may want to consult your splunk administrator or professional services if you have not used splunk at all before.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...