Syslog Data not indexing

[westpointis]

Hello. We are currently running Splunk 7.0.2 on Windows Server 2012 r2 and are attempting to send syslog data from our Barracuda Web Content Filter to Splunk for indexing.

I have setup the syslogging on the Barracuda to send to the IP address of the Splunk server at TCP port 514.

I have ensured that Splunk is listening to TCP port 514 via the GUI and also through netstat.

My index is still sitting at 0.00mb and no data appears to be coming in.

There are no firewalls between the Splunk server and the WCF. Splunk is running under the local system account in Windows.

Any thoughts? Thank you.

[nodokasa · Accepted solution]

Syslog is typically sent via UDP, not TCP.
I would try doing a wireshark dump on the server to check that you're not sending the SYSLOG to UDP instead of TCP.

We're doing SYSLOG collection on our monitoring system (which then commits data to Splunk), and discussed sending this into Splunk, but the problem is that SYSLOG is UDP; It's a fire-and-forget protocol, so there would be no assurance for having the data. This is why typically installing the Universial Forwarder directly on the machine you want to collect data from is a better idea. (-:
Cheers.

[westpointis]

So, after doing a wireshark dump, I was definitely able to see the data being sent via UDP, changed my data input from TCP to UDP...and there it is.

Thanks for your help!

[schusser]

I definitely recommend sending this to syslog locally and ingesting the files rather than the listener approach, restarts and reboots will cause gaps in data. Particularly in Windows.