Log Collection and forward to SPLUNK

[BLRINGLER]

Hello

I have a request to have a SYSLOG server and a SPLUNK server. The request is to have the logs from external sources written to the SYSLOG server then forwarded and read by the SPLUNK server.

I searched and read an old post

https://answers.splunk.com/answers/28680/universal-forwarder-vs-dedicated-rsyslog-syslog-ng-servers-...

I am using MS Server 2012 R2 for both, SPLUNK Enterprise 7

How would I:

1. Have logs from different sources (Cisco, Microsoft, Linux) written to a SYSLOG Server.

2. Forward the log to a SPLUNK server

Thanks

[petercow · Accepted solution]

1) yes
2) Yes - see below
3) You can have the syslog server also be the splunk server (in which case you don't need the forwarder), but for reasons of scalability, etc., I would have them be 2 separate servers.

[BLRINGLER]

Thank you

The scalability was the main factor

Thanks Again

[petercow]

1) configure the sources to have your server be their logging destination (each kind of device does that differently, but the result is the same).

2) install a Splunk Universal forwarder on that box, to monitor the syslog file being generated from step 1.

[BLRINGLER]

Thanks

1) The logging destination is the SYSLOG Server?

2) Install the Splunk Universal Forwarder on the SYSLOG server to forward to the SPLUNK Server?

So the logs go to one server and the actual Splunk reports on another server? Or everything should be on one server

Thanks,