How to send audit.log to external system?

[ClausBom]

Hi guys,

In order to comply with auditor demands, we need to send the audit.log files from (Linux-based) indexers and search heads to an external system (not Splunk).

Is there any way, we can get Splunk itself to send these files to e.g. syslog, or do we have to find another way to do it?

I have read http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd and http://answers.splunk.com/answers/116701/how-to-send-audit-and-splunkd-logs-of-splunk-instance-to-ex... but still not found the silver bullet 😕

Regards
Claus

[LukeMurphey · Accepted solution]

outputs.conf is likely the right approach. For example, you could use something like this:

inputs.conf

[monitor://$SPLUNK_HOME/var/log/splunk/audit.log*]
_SYSLOG_ROUTING = syslog-output

outputs.conf

[syslog]
defaultGroup = syslog-output

[syslog:syslog-output]
disabled = false
# Define your syslog server here
server = 1.2.3.4:514
# This assumes you are using TCP, which is recommended
type = tcp

You can also forward data by index.

[aanataliya]

Hi @LukeMurphey,

How do we forward Splunk Cloud's log. We are using Splunk cloud without Deployment server and we do not have access to CLI. How do I forwarder Splunk Cloud's audit log to external system?