Syslog Data Reaching Forwarder?

[itsmevic]

Hello, I need to check to see if Syslog data is reaching my forwarders.  What would be the best query to use to check this?

[General_Talos · Accepted solution]

As per my understanding for syslog server logs monitoring, you have to install a Splunk UF agent on syslog server and perform "file & folder monitoring" (to the logs which you want to onboard into Splunk).

Within input.conf you define logs details like

index = XYZ
sourcetype= ABC

if your logs are reporting to Splunk, you can check it by

| tstats count where index=ZYX sourcetype=ABC by sourcetype _time 
|timechart sum(count) as count by sourcetype

[gcusello]

Hi @itsmevic,

you can run a simple search on the index where you store the logs that you ingest with that input from your syslog.

You can recognize them using the host field.

in other words:

index=your_index host=your_host

Ciao.

Giuseppe