Getting Data In

Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server?

rashid47010
Communicator

We have different syslog sources.
Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server and then install the UF to read the files from that paths?

Please share some scenarios or Splunk configuration.

0 Karma

rgreer
Path Finder

What you outlined is exactly what we ended up doing in each of our data centers. Kiwi Syslog on a virtual machine with a UF pulling in each log with the correct sourcetype. Our corporate IT guys ended up using Rsyslog on a Redhat VM with a UF as well. Both ended up being cheap, cost effective solutions to our syslog problem.

0 Karma

xpac
SplunkTrust
SplunkTrust

On purpose or not, you ended up doing the best practice for that kind of use case. 😉
Syslog server writing to disk and Splunk monitoring those files is the recommended approach.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!