Getting Data In

How to forward logs using rsyslog

asharma21193
New Member

There are around 400 servers, which are already forwarding required logs to IBM Qradar using rsyslog. Instead of installing universal forwarders in every server, I want to add one more forwarder (Splunk HWF) in rsyslog config in order to receive logs from every servers.

• What utility I need to install on log Collector
• Can I install this utility on HWF itself as load is very less on this server
• Where I will define index and sourcetype details in this case

0 Karma

starcher
Influencer

Put UF on your rsyslog box and read the files you are already writing.

0 Karma

starcher
Influencer
0 Karma

asharma21193
New Member

it is IBM log collector that we need to decommission. Kindly help with standard solution.

0 Karma

starcher
Influencer

The standard solution is to run a syslog collector with a UF as stated. You could make a new one and redirect syslog there.

0 Karma

asharma21193
New Member

Can I install this utility on HWF itself as load is very less on this server ?
Where I will define index and sourcetype details in this case ?

0 Karma

starcher
Influencer

You shouldn't run a heavy forwarder to pickup syslog. You should use a universal forwarder.

Configuration of either install can do it, however inputs and getting data in can be found at https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Getstartedwithgettingdatain

You may want to consult your splunk administrator or professional services if you have not used splunk at all before.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...