How to send log file from switch/router directly to Splunk?

[eholz1]

Hello Splunkers,

Is a splunk forwarder required to send data to splunk from a switch or router?

Can I configure the the device to send logs directly to the splunk like using port 514.

Like in a cisco config - "logging host", etc

Thanks

EWH

[smurf · Accepted solution]

Hi,

it is possible to send directly to Splunk. You can set up input in Splunk (it would need to be either some kind of forwarder or indexer) to listen on a port. You can define it in GUI or in inputs.conf and it would look something like this. You can ommit the host and have it listen for any connection on a port.

[tcp://syslog.corp.example.net:514]
sourcetype = cisco:ise
index = cisco

On the network device, you would enter the IP address of the Splunk instance and whatever port you specified and you start receiving the data.

Keep in mind that it would be better to use a syslog server for this. Because when you restart the ingesting Splunk instance, you could start losing data. If you have multiple devices that you want to set up like this I would look at the SC4S project: https://splunk.github.io/splunk-connect-for-syslog/main/

[PickleRick]

One more thing. You can't run input on port 514 if you run splunk with ordinary user (non-root). And running splunk as root is not something you should do.

[jotne]

To be more exact, you can not use any port below 1024 in Splunk if Splunk does not run as root user.

An you should NOT run Splunk as root.  So have a look at my post here on how to install Splunk as non root user and use Rsyslog to get syslog data inn to Splunk.

https://forum.mikrotik.com/viewtopic.php?p=888802#p888802

[eholz1]

gosh, why did I not think of that!! Been awhile since my splunk training!

thanks!!

eholz1