Getting Data In

Sending Splunk Data to Syslog Server

Communicator

I have Splunk receiving data from various sources, but I would like to be able to send that data on to another syslog collector. I have read that various documents on how this should be achieved and I have added the following to the outputs.conf

[syslog:my_syslog_group]
server = 192.168.1.1:514
type = udp

Yet the data is not getting sent to that collector. This new collector is actually running on the same host as Splunk, but is using the default syslog port of UDP/514 where as Splunk is using a different port.

Firewalls are not causing the problem as I have tested this with the firewalls disabled.

What else do I need to do to make this work?

Tags (1)
0 Karma
1 Solution

Explorer

If you use a free license this feature is disabled. (I'm pretty sure but not 100%)

View solution in original post

0 Karma

Explorer

If you use a free license this feature is disabled. (I'm pretty sure but not 100%)

View solution in original post

0 Karma

New Member

Hi
I have similar probelm , so I use non-license splunk(it should be as your mean ==>free license), whether I only send TCPData but could not send syslog , right ??

wyldkao

0 Karma

Communicator

Thank you. Yes I have had to revert to the Free License so that explains it.

0 Karma

Legend

Is this a full-blown Splunk instance (indexer or likewise) or a Universal Forwarder?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!