Getting Data In

Syslog vs TA apps to parse network traffic sourcetypes

sdintino_splunk
Splunk Employee
Splunk Employee

We are trying to ingest some logs for events from different network appliances such as F5 load balancers.  Can you please tell us whether we should be logging them to a syslog and ingesting them from there or if we should be collecting them with splunk listening on a UDP port?

Labels (1)
0 Karma

sdintino_splunk
Splunk Employee
Splunk Employee

Thank you @richgalloway and @isoutamo ! This confirms what I'd thought. Much appreciated!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to NOT log UDP/TCP directly to Splunk.  Doing so can lead to data loss.  Syslog events should go to a syslog server.

---
If this reply helps you, an upvote would be appreciated.

isoutamo
SplunkTrust
SplunkTrust

Hi

just like @richgalloway said. If you are logging UDP directly to splunk it’s not if you lost events, it’s how often and how much you will be lost them.

r. Ismo

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!