Dear Experts,
Currently we have test environment where we have one indexer and search head however we need to forward the syslog data(On port 514) received from the indexer to another syslog server and also keep local copy for our search head for investigation/log retention purpose.
Thanks in advance
Hi,
Edit: I just realised - according to the documentation - only Heavy Forwarders are able to output syslog data. You still may try it.
simply add an outputs.conf on your indexer with something like this:
[syslog]
defaultGroup=YourSyslogServerGroup
[syslog:YourSyslogServerGroup]
server = 1.2.3.4:514
This should do the job. For further details, review the documentation.
Skalli
Hi,
Edit: I just realised - according to the documentation - only Heavy Forwarders are able to output syslog data. You still may try it.
simply add an outputs.conf on your indexer with something like this:
[syslog]
defaultGroup=YourSyslogServerGroup
[syslog:YourSyslogServerGroup]
server = 1.2.3.4:514
This should do the job. For further details, review the documentation.
Skalli
how are you receiving the data? You use Search Head as your heavy-forwarder to send to Indexder?
Or do you want to send the data from Indexer to syslog server?