Pushing syslog to Splunk indexer

[rahul2gupta]

Hi ,

A user is complaining that :

From hostname1, we are pushing the syslog to Splunk indexer server IP - 10.20.30.40 via Port 55XY,
can you please check if anything needs to be done from Splunk end to see the data in Splunk.

Can anyone please me on this.

Regards,

Rahul

[PickleRick]

Don't push syslog directly to splunk indexer. At least not in production environment.

Use some intermediate syslog receiver (sc4s is quite popular for this, I myself am a huge fan of rsyslog) from which splunk ingests the data in other ways (HEC, files).

[rahul2gupta]

Thanks @PickleRick for reply.

Use some intermediate syslog receiver (sc4s is quite popular for this, I myself am a huge fan of rsyslog) from which splunk ingests the data in other ways (HEC, files) -- How this can be achieved. Can you please provide us the step?

Regards,

Rahul

[PickleRick]

https://lists.archive.carbon60.com/rsyslog/users/25542#25542

(that's general idea for rsyslog but if you've never used it before, it may not be that straightforward)

or

https://splunkbase.splunk.com/app/4740/