Can Splunk be used as a syslog server receiving syslog messages directly from a firewall or is a separate syslog server required?
Yes, it can. see examples here
Update: working link is here http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports
But keep in mind, if you setup a single splunk indexer to receive syslog, your syslog data is lost while you restart your splunk.
I'm not talking about the already indexed syslog data. If you setup Splunk to receive syslog data and reboot / restart your Splunk server, who will then receive those syslog packets? Correct, no one will = data lost in UDP space.......
To prevent such things you could setup a syslog-ng server as master syslog collector, save everything into a file and use a universal forwarder to read and sent this file to the indexer.
hope this makes more sense now. Cheers , MuS
What do you mean by "your syslog data is lost while you restart your Splunk"? Splunk stores syslog input inside of files along with all of it's other data-- it won't lose the data due to a simple restart.