Getting Data In

Using Splunk universal forwarder to forward log into Kiwi Syslog Server

ailing1909
New Member

Is there any ways for me to forward log into Kiwi Syslog Server by using Splunk universal forwarder?

Tags (1)
0 Karma

harsmarvania57
Ultra Champion

Hi @ailing1909,

From Universal Forwarder you can route data to TCP server without filtering raw data but not UDP. If your syslog can accept data on TCP port and you do not want to filter raw data then you can configure UF outputs.conf to send data to Syslog server, please refer https://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Forwarddatatothird-partysystemsd#TCP_d...

If you want to send data from UF to Syslog server over UDP then you need to use Heavy Forwarder, you can't achieve it via UF.

I hope this helps.

Thanks,
Harshil

0 Karma

ailing1909
New Member

hi! is there other way that i can do so? as i configure UF output.conf file, however i still didn't manage to send through

0 Karma

harsmarvania57
Ultra Champion

Can you please let us know how you configured on UF and in which configuration files?

0 Karma

ailing1909
New Member

i config in UF output.conf under UF\etc\system\local\output.conf this what i did

[tcpout]
server = 192.168.1.113:9997
sendCookedData = false
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 192.168.1.113:9997

[tcpout-server://192.168.1.113:9997]

0 Karma

harsmarvania57
Ultra Champion

Config which you have provided it looks like UF to Indexer configuration.

If you want to send all data from UF to Syslog server over TCP only then please use below configuration in outputs.conf

[tcpout]
defaultGroup = syslog_group

[tcpout:fastlane]
server = <SYSLOG IP>:<SYSLOG TCP PORT>
sendCookedData = false

If you want to send data to Indexer and Syslog server over TCP then you can use below configuration

[tcpout]
defaultGroup = indexer_group, syslog_group

[tcpout:indexer_group]
server = <IDX IP>:<IDX PORT>

[tcpout:syslog_group]
server = <SYSLOG IP>:<SYSLOG TCP PORT>
sendCookedData = false
0 Karma

ailing1909
New Member

thanks for the help 🙂

0 Karma

lycollicott
Motivator

First of all, why on earth would you want to do that? Send it to Splunk instead.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...