Getting Data In
Highlighted

Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server?

Communicator

We have different syslog sources.
Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server and then install the UF to read the files from that paths?

Please share some scenarios or Splunk configuration.

0 Karma
Highlighted

Re: Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server?

Explorer

What you outlined is exactly what we ended up doing in each of our data centers. Kiwi Syslog on a virtual machine with a UF pulling in each log with the correct sourcetype. Our corporate IT guys ended up using Rsyslog on a Redhat VM with a UF as well. Both ended up being cheap, cost effective solutions to our syslog problem.

0 Karma
Highlighted

Re: Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server?

SplunkTrust
SplunkTrust

On purpose or not, you ended up doing the best practice for that kind of use case. 😉
Syslog server writing to disk and Splunk monitoring those files is the recommended approach.

0 Karma