Getting Data In

Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server?

rashid47010
Communicator

We have different syslog sources.
Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server and then install the UF to read the files from that paths?

Please share some scenarios or Splunk configuration.

0 Karma

rgreer
Path Finder

What you outlined is exactly what we ended up doing in each of our data centers. Kiwi Syslog on a virtual machine with a UF pulling in each log with the correct sourcetype. Our corporate IT guys ended up using Rsyslog on a Redhat VM with a UF as well. Both ended up being cheap, cost effective solutions to our syslog problem.

0 Karma

xpac
SplunkTrust
SplunkTrust

On purpose or not, you ended up doing the best practice for that kind of use case. 😉
Syslog server writing to disk and Splunk monitoring those files is the recommended approach.

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...