Getting Data In

Is it possible to receive and forward logs using a Splunk universal forwarder on Linux?

dhavamanis
Builder

Can you please help us?

Is it possible to receive and forward logs using a Splunk universal forwarder? Because logs are coming from secure network and not allowed to access internet, we have installed the forwarder on a host that has access to internet and is getting logs using rsync, then forwarding to Splunk farm. However, it's consuming more storage on the forwarder node side. To avoid that, is there a way to receive and forward using a universal forwarder on Linux?

0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

You could have the forwarder listen on a particular port for syslog traffic (usually port 514) which could then be forwarded using the normal forwarder behaviour.

View solution in original post

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

You could have the forwarder listen on a particular port for syslog traffic (usually port 514) which could then be forwarded using the normal forwarder behaviour.

0 Karma

dhavamanis
Builder

i tested and its working fine. thank you!.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...