Impact of installing syslog-ng in universal forwarder

[ankithnageshshe]

Hello Splunkers,

I have a requirement wherein I need to forward the data to the third-party system apart from sending logs to Splunk.

What is the impact of having syslog-ng along with universal forwarder that sends almost the same amount (mostly 75% same data) to a third party system?

Will this have a performance issue like "parsing queue getting filled" / network bandwidth consumption.

Which is the best way to integrate splunk to third party system.?

[pruthvikrishnap]

Hi Ankith,

What is the impact of having syslog-ng along with universal forwarder that sends almost the same amount (mostly 75% same data) to a third party system?
Splunk has the capability of forwarding logs to third party applications in raw syslog format, its obviously a performance hit when you plan to use both Splunk and syslog for accomplishing the same task.

Will this have a performance issue like "parsing queue getting filled" / network bandwidth consumption.
https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html

Which is the best way to integrate splunk to third party system.?
It depends on the third party applications which you are planning to forward logs to.
https://docs.splunk.com/Documentation/Splunk/7.2.0/Forwarding/Forwarddatatothird-partysystemsd

[ankithnageshshe]

Thanks Pruthvi for the reply.

[frobert]

Hi,
You probably do not need both the universal forwarder and syslog-ng, you can forward logs to Splunk and third-party systems with syslog-ng alone.

[ankithnageshshe]

Thanks Robert for the reply