Getting Data In

How to send audit.log to external system?

ClausBom
Explorer

Hi guys,

In order to comply with auditor demands, we need to send the audit.log files from (Linux-based) indexers and search heads to an external system (not Splunk).

Is there any way, we can get Splunk itself to send these files to e.g. syslog, or do we have to find another way to do it?

I have read http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd and http://answers.splunk.com/answers/116701/how-to-send-audit-and-splunkd-logs-of-splunk-instance-to-ex... but still not found the silver bullet 😕

Regards
Claus

1 Solution

LukeMurphey
Champion

outputs.conf is likely the right approach. For example, you could use something like this:

inputs.conf

[monitor://$SPLUNK_HOME/var/log/splunk/audit.log*]
_SYSLOG_ROUTING = syslog-output

outputs.conf

[syslog]
defaultGroup = syslog-output

[syslog:syslog-output]
disabled = false
# Define your syslog server here
server = 1.2.3.4:514
# This assumes you are using TCP, which is recommended
type = tcp

You can also forward data by index.

View solution in original post

LukeMurphey
Champion

outputs.conf is likely the right approach. For example, you could use something like this:

inputs.conf

[monitor://$SPLUNK_HOME/var/log/splunk/audit.log*]
_SYSLOG_ROUTING = syslog-output

outputs.conf

[syslog]
defaultGroup = syslog-output

[syslog:syslog-output]
disabled = false
# Define your syslog server here
server = 1.2.3.4:514
# This assumes you are using TCP, which is recommended
type = tcp

You can also forward data by index.

aanataliya
Explorer

Hi @LukeMurphey,

How do we forward Splunk Cloud's log. We are using Splunk cloud without Deployment server and we do not have access to CLI. How do I forwarder Splunk Cloud's audit log to external system?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...