Getting Data In

Sending Splunk Data to Syslog Server

balcv
Contributor

I have Splunk receiving data from various sources, but I would like to be able to send that data on to another syslog collector. I have read that various documents on how this should be achieved and I have added the following to the outputs.conf

[syslog:my_syslog_group]
server = 192.168.1.1:514
type = udp

Yet the data is not getting sent to that collector. This new collector is actually running on the same host as Splunk, but is using the default syslog port of UDP/514 where as Splunk is using a different port.

Firewalls are not causing the problem as I have tested this with the firewalls disabled.

What else do I need to do to make this work?

Tags (1)
0 Karma
1 Solution

sbaryakov
Explorer

If you use a free license this feature is disabled. (I'm pretty sure but not 100%)

View solution in original post

0 Karma

sbaryakov
Explorer

If you use a free license this feature is disabled. (I'm pretty sure but not 100%)

0 Karma

wyldkao
New Member

Hi
I have similar probelm , so I use non-license splunk(it should be as your mean ==>free license), whether I only send TCPData but could not send syslog , right ??

wyldkao

0 Karma

balcv
Contributor

Thank you. Yes I have had to revert to the Free License so that explains it.

0 Karma

Ayn
Legend

Is this a full-blown Splunk instance (indexer or likewise) or a Universal Forwarder?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...