Getting Data In

Syslog Data Reaching Forwarder?

itsmevic
Communicator

Hello, I need to check to see if Syslog data is reaching my forwarders.  What would be the best query to use to check this?

Labels (1)
1 Solution

General_Talos
Path Finder

As per my understanding for syslog server logs monitoring, you have to install a Splunk UF agent on syslog server and perform "file & folder monitoring" (to the logs which you want to onboard into Splunk).

Within input.conf you define logs details like

index = XYZ
sourcetype= ABC

 

 

if your logs are reporting to Splunk, you can check it by

 

| tstats count where index=ZYX sourcetype=ABC by sourcetype _time 
|timechart sum(count) as count by sourcetype

View solution in original post

General_Talos
Path Finder

As per my understanding for syslog server logs monitoring, you have to install a Splunk UF agent on syslog server and perform "file & folder monitoring" (to the logs which you want to onboard into Splunk).

Within input.conf you define logs details like

index = XYZ
sourcetype= ABC

 

 

if your logs are reporting to Splunk, you can check it by

 

| tstats count where index=ZYX sourcetype=ABC by sourcetype _time 
|timechart sum(count) as count by sourcetype

gcusello
SplunkTrust
SplunkTrust

Hi @itsmevic,

you can run a simple search on the index where you store the logs that you ingest with that input from your syslog.

You can recognize them using the host field.

in other words:

index=your_index host=your_host

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...