Getting Data In

Using Splunk Forwarder on syslog server to forward to splunk server


Syslogs already has all the logs from other server using snare udp 514

Do I need to configure anything on the splunk forwarder to get logs from syslog?

Or it gets the syslogs on the syslog server automatically?

Tags (1)
0 Karma

Path Finder

You'd need to set up your data inputs under

manager -> data inputs -> UDP -> NEW

From there you just add the port you want to use and point your syslog server to the port on the splunk server. However, if you have an agent running on the syslog server, it might be better to get syslog to pump the file to disk and read that. Doing that ensures that you don't lose any data if the splunk server goes down or if the network has issues. Otherwise, you can just share the drive to the splunk server and let Splunk pick it up as a local file.

0 Karma


You can point any syslog towards the splunk server and configure the splunk server to receive syslog. So you can point snare to splunk, but you need to configure a receiving port first.

Or you can have a splunk forwarder índex the files on the syslog server and send it to splunk.

0 Karma


so i just need to configure receiving index for splunk forwarder to 9997

for the syslog server, splunk forwarder automatically gets its data from syslog? (I don't need to do any config to syslog to forward the logs to splunk forwarder)?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>