Getting Data In

Network device logs

jmrubio
Path Finder

Hello!

I wanted to ask what is the best way/configuration to get network device logs directly into splunk?

Thanks in advance!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, there is, but it's not considered a Best Practice.

Define a TCP input to read the logs from the selected port.  See https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to not ingest device logs directly into Splunk.  Any time Splunk restarts data sent by the devices during the downtime will be lost.  The recommended approach is to send the logs (usually in syslog format) to a dedicated receiver (syslog-ng or Splunk Connect for Syslog (SC4S)) and forward them to Splunk from there.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jmrubio
Path Finder

@richgalloway  Is there any way to not have to use a separate syslog server? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, there is, but it's not considered a Best Practice.

Define a TCP input to read the logs from the selected port.  See https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

---
If this reply helps you, Karma would be appreciated.

jmrubio
Path Finder

I will try this out. Thanks!

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...