Getting Data In

How to send audit.log to external system?

ClausBom
Explorer

Hi guys,

In order to comply with auditor demands, we need to send the audit.log files from (Linux-based) indexers and search heads to an external system (not Splunk).

Is there any way, we can get Splunk itself to send these files to e.g. syslog, or do we have to find another way to do it?

I have read http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd and http://answers.splunk.com/answers/116701/how-to-send-audit-and-splunkd-logs-of-splunk-instance-to-ex... but still not found the silver bullet 😕

Regards
Claus

1 Solution

LukeMurphey
Champion

outputs.conf is likely the right approach. For example, you could use something like this:

inputs.conf

[monitor://$SPLUNK_HOME/var/log/splunk/audit.log*]
_SYSLOG_ROUTING = syslog-output

outputs.conf

[syslog]
defaultGroup = syslog-output

[syslog:syslog-output]
disabled = false
# Define your syslog server here
server = 1.2.3.4:514
# This assumes you are using TCP, which is recommended
type = tcp

You can also forward data by index.

View solution in original post

LukeMurphey
Champion

outputs.conf is likely the right approach. For example, you could use something like this:

inputs.conf

[monitor://$SPLUNK_HOME/var/log/splunk/audit.log*]
_SYSLOG_ROUTING = syslog-output

outputs.conf

[syslog]
defaultGroup = syslog-output

[syslog:syslog-output]
disabled = false
# Define your syslog server here
server = 1.2.3.4:514
# This assumes you are using TCP, which is recommended
type = tcp

You can also forward data by index.

aanataliya
Explorer

Hi @LukeMurphey,

How do we forward Splunk Cloud's log. We are using Splunk cloud without Deployment server and we do not have access to CLI. How do I forwarder Splunk Cloud's audit log to external system?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...