Using Splunk universal forwarder to forward log into Kiwi Syslog Server

[ailing1909]

Is there any ways for me to forward log into Kiwi Syslog Server by using Splunk universal forwarder?

[harsmarvania57]

Hi @ailing1909,

From Universal Forwarder you can route data to TCP server without filtering raw data but not UDP. If your syslog can accept data on TCP port and you do not want to filter raw data then you can configure UF outputs.conf to send data to Syslog server, please refer https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Forwarddatatothird-partysystemsd#TCP_d...

If you want to send data from UF to Syslog server over UDP then you need to use Heavy Forwarder, you can't achieve it via UF.

I hope this helps.

Thanks,
Harshil

[ailing1909]

hi! is there other way that i can do so? as i configure UF output.conf file, however i still didn't manage to send through

[harsmarvania57]

Can you please let us know how you configured on UF and in which configuration files?

[ailing1909]

i config in UF output.conf under UF\etc\system\local\output.conf this what i did

[tcpout]
server = 192.168.1.113:9997
sendCookedData = false
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 192.168.1.113:9997

[tcpout-server://192.168.1.113:9997]

[harsmarvania57]

Config which you have provided it looks like UF to Indexer configuration.

If you want to send all data from UF to Syslog server over TCP only then please use below configuration in outputs.conf

[tcpout]
defaultGroup = syslog_group

[tcpout:fastlane]
server = <SYSLOG IP>:<SYSLOG TCP PORT>
sendCookedData = false

If you want to send data to Indexer and Syslog server over TCP then you can use below configuration

[tcpout]
defaultGroup = indexer_group, syslog_group

[tcpout:indexer_group]
server = <IDX IP>:<IDX PORT>

[tcpout:syslog_group]
server = <SYSLOG IP>:<SYSLOG TCP PORT>
sendCookedData = false

[ailing1909]

thanks for the help 🙂

[lycollicott]

First of all, why on earth would you want to do that? Send it to Splunk instead.