Questions about CentOS rsyslog and Splunk configuration

[InteractM]

I have a dedicated syslog server running on CentOS6 (rsyslog) which gathers all logs from other servers/devices (stored in a database).

My questions are:
1. Can I install Splunk on same server?
2. What do I need to do to have Splunk as syslog analyzer (and to keep rsyslog as syslog server)?

Thanks

[jtrucks · Accepted solution]

You'll need to have rsyslog send a copy to Splunk and a copy into the database. This isn't hard to do with rsyslog.

You could send directly to a Splunk TCP input using:

*.* @@centralserver.example.net

in addition to your database configuration.

Alternatively, have the files written to disk and to your database, and then just have Splunk read those log files.

Splunk automatically parses syslog formatted logs, so you can just send it directly or have it read the files directly.

That's it. 🙂

[InteractM]

OK, got it fixed. There were two issues:

1) to use local IP instead a domain 'localhot'
2) Line *.* @@127.0.0.1 must be added after a line with saving to the DB (as a primary logs storage)

[InteractM]

Well, I have added

*.* @@localhost

to the rsyslog config and it looks like is not gathering any data (wrong syntax?) neither Syslog seeing anything from syslog (added TCP listening on port 514)

Any clue?

Thanks

[InteractM]

@@centralserver.example.net is this a location of the server where is Splunk located? Is this not going to loop because is this on same server or it will be parallel connection?

Current rsyslog config connection looks like:
*.* :ommysql:127.0.0.1,rsysdb,user,pass