Network device logs

[jmrubio]

Hello!

I wanted to ask what is the best way/configuration to get network device logs directly into splunk?

Thanks in advance!

[richgalloway]

Best Practice is to not ingest device logs directly into Splunk.  Any time Splunk restarts data sent by the devices during the downtime will be lost.  The recommended approach is to send the logs (usually in syslog format) to a dedicated receiver (syslog-ng or Splunk Connect for Syslog (SC4S)) and forward them to Splunk from there.

[jmrubio]

@richgalloway  Is there any way to not have to use a separate syslog server? 

[richgalloway · Accepted solution]

Yes, there is, but it's not considered a Best Practice.

Define a TCP input to read the logs from the selected port.  See https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

[jmrubio]

I will try this out. Thanks!