Getting Data In

How to send log file from switch/router directly to Splunk?

eholz1
Contributor

Hello Splunkers,

Is a splunk forwarder required to send data to splunk from a switch or router?

Can I configure the the device to send logs directly to the splunk like using port 514.

Like in a cisco config - "logging host", etc

 

Thanks

EWH

Labels (1)
Tags (1)
0 Karma
1 Solution

smurf
Communicator

Hi,

it is possible to send directly to Splunk. You can set up input in Splunk (it would need to be either some kind of forwarder or indexer) to listen on a port. You can define it in GUI or in inputs.conf and it would look something like this. You can ommit the host and have it listen for any connection on a port.

[tcp://syslog.corp.example.net:514]
sourcetype = cisco:ise
index = cisco

On the network device, you would enter the IP address of the Splunk instance and whatever port you specified and you start receiving the data.

Keep in mind that it would be better to use a syslog server for this. Because when you restart the ingesting Splunk instance, you could start losing data. If you have multiple devices that you want to set up like this I would look at the SC4S project: https://splunk.github.io/splunk-connect-for-syslog/main/

View solution in original post

smurf
Communicator

Hi,

it is possible to send directly to Splunk. You can set up input in Splunk (it would need to be either some kind of forwarder or indexer) to listen on a port. You can define it in GUI or in inputs.conf and it would look something like this. You can ommit the host and have it listen for any connection on a port.

[tcp://syslog.corp.example.net:514]
sourcetype = cisco:ise
index = cisco

On the network device, you would enter the IP address of the Splunk instance and whatever port you specified and you start receiving the data.

Keep in mind that it would be better to use a syslog server for this. Because when you restart the ingesting Splunk instance, you could start losing data. If you have multiple devices that you want to set up like this I would look at the SC4S project: https://splunk.github.io/splunk-connect-for-syslog/main/

PickleRick
SplunkTrust
SplunkTrust

One more thing. You can't run input on port 514 if you run splunk with ordinary user (non-root). And running splunk as root is not something you should do.

0 Karma

jotne
Builder

To be more exact, you can not use any port below 1024 in Splunk if Splunk does not run as root user.

An you should NOT run Splunk as root.  So have a look at my post here on how to install Splunk as non root user and use Rsyslog to get syslog data inn to Splunk.

https://forum.mikrotik.com/viewtopic.php?p=888802#p888802

0 Karma

eholz1
Contributor

gosh, why did I not think of that!! Been awhile since my splunk training!

 

thanks!!

eholz1

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...