How to forward logs via rsyslogd?

[rahul2gupta]

Hi,

We are facing issue that we are unable to forward logs into Splunk via rsyslogd. They are forwarding as shown below.

if $syslogfacility-text == "local4" then {

action(

        type="omfwd"

        Target="syslog.ad.crop"

        Port="5514"

        Protocol="tcp"

 

        ## queue.type default Direct

        queue.type="LinkedList"

        ## queue.size default 1000

        queue.size="100000"

        queue.filename="local4"

    )

    stop

}

logs were getting ingested till 8th feb . please help to resolve this issue.

Regards,

Rahul