Getting Data In

Trouble forwarding splunkd.log output to syslog.

Engager

I must be missing something very simple here so bear with me.
I am running a Splunk universal forwarder instance, and I would like to forward its internal logs (e.g. splunkd.log) to my own Syslog server.

I would like to do this for my own internal audit logging separate from the indexer that is connected to the forwarder. Is there any support for this?
I have tried to set up rsyslog to watch splunkd.log but there seem to be some inotify shenanigans going on and rsyslog fails to recognize that the log file is being updated.

0 Karma

Splunk Employee
Splunk Employee

To have a UF forward to syslog, check
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd

Keep in mind that if a forwarder send to a splunk indexer AND to a syslog server. It will stop sending to both if one of them is not responding, not great for HA.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!