Getting Data In

How to forward logs using rsyslog

asharma21193
New Member

There are around 400 servers, which are already forwarding required logs to IBM Qradar using rsyslog. Instead of installing universal forwarders in every server, I want to add one more forwarder (Splunk HWF) in rsyslog config in order to receive logs from every servers.

• What utility I need to install on log Collector
• Can I install this utility on HWF itself as load is very less on this server
• Where I will define index and sourcetype details in this case

0 Karma

starcher
SplunkTrust
SplunkTrust

Put UF on your rsyslog box and read the files you are already writing.

0 Karma

starcher
SplunkTrust
SplunkTrust
0 Karma

asharma21193
New Member

it is IBM log collector that we need to decommission. Kindly help with standard solution.

0 Karma

starcher
SplunkTrust
SplunkTrust

The standard solution is to run a syslog collector with a UF as stated. You could make a new one and redirect syslog there.

0 Karma

asharma21193
New Member

Can I install this utility on HWF itself as load is very less on this server ?
Where I will define index and sourcetype details in this case ?

0 Karma

starcher
SplunkTrust
SplunkTrust

You shouldn't run a heavy forwarder to pickup syslog. You should use a universal forwarder.

Configuration of either install can do it, however inputs and getting data in can be found at https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Getstartedwithgettingdatain

You may want to consult your splunk administrator or professional services if you have not used splunk at all before.

Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...