Urgent Help required , Splunk Indexer to forward data to syslog server(rsyslog or thrid party)

[sumitkathpal292]

Dear Experts,

Currently we have test environment where we have one indexer and search head however we need to forward the syslog data(On port 514) received from the indexer to another syslog server and also keep local copy for our search head for investigation/log retention purpose.

Thanks in advance

[skalliger · Accepted solution]

Hi,

Edit: I just realised - according to the documentation - only Heavy Forwarders are able to output syslog data. You still may try it.

simply add an outputs.conf on your indexer with something like this:

[syslog]
defaultGroup=YourSyslogServerGroup

[syslog:YourSyslogServerGroup]
server = 1.2.3.4:514

This should do the job. For further details, review the documentation.

Skalli

[koshyk]

how are you receiving the data? You use Search Head as your heavy-forwarder to send to Indexder?
Or do you want to send the data from Indexer to syslog server?