Hello!
I wanted to ask what is the best way/configuration to get network device logs directly into splunk?
Thanks in advance!
Yes, there is, but it's not considered a Best Practice.
Define a TCP input to read the logs from the selected port. See https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports
Best Practice is to not ingest device logs directly into Splunk. Any time Splunk restarts data sent by the devices during the downtime will be lost. The recommended approach is to send the logs (usually in syslog format) to a dedicated receiver (syslog-ng or Splunk Connect for Syslog (SC4S)) and forward them to Splunk from there.
@richgalloway Is there any way to not have to use a separate syslog server?
Yes, there is, but it's not considered a Best Practice.
Define a TCP input to read the logs from the selected port. See https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports
I will try this out. Thanks!