Getting Data In

Is it possible to send Syslog data to a forwarder instead of an indexer?

bread555
Explorer

I am using Suricata IDS to send Syslog data to an indexer. However, due to some overload (and very noisy Suricata) I wanted to shift that to sending it instead to a forwarder (preferably a local forwarder). Is that possible?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Sure. Best practice is to have a syslog daemon receive the data, write it to a log file, and let a Splunk Universal Forwarder send that file to your indexers.

View solution in original post

grijhwani
Motivator

There are lots (well at least a couple) of good reasons for running a separate syslog capture process.

Firstly, irrespective of the choice of syslog server you don't lose log data on those occasions when the Splunk service has to be restarted. Syslog is by default UDP, and volatile. If you fail to capture it it is gone. Having a separate server ensures that the syslog capture is continuous, even if the forwarding is interrupted.

Secondly, if using syslog-ng the log data can be saved into meaningful hierarchical (user-definable) trees which can then be used further to add a layer of value in the indexing.

martin_mueller
SplunkTrust
SplunkTrust

Sure. Best practice is to have a syslog daemon receive the data, write it to a log file, and let a Splunk Universal Forwarder send that file to your indexers.

bread555
Explorer

Well then. Sweet point goodness for you kind sir.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Sure, you can have the UF listen to syslog directly. It can receive network data just like the indexer can.

0 Karma

bread555
Explorer

Thats what I was thinking, but I was hoping there was a way to cut out the middle man of a syslog daemon. If there is no way to do this natively in Splunk I'll give you full and due karma goodness!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...