Getting Data In

Using syslog to forward data or Universal forwarder

New Member

I have setup splunk 6.1.1. In our environment we are running rsyslog in a failover configuration.
Rsyslog is collecting all the data and then forwarding the data to Splunk. Splunk is configured
with a tcp receiver on port 514. The one issue we are running into is we are getting a large number
of entries that are not syslog compliant. We are then getting hosts with names such as 2014,14z etc.
I am looking for advice on what would be the best way to reduce these errors? Would the universal forwarder work better at detecting log types and then forwarding it to Splunk?

0 Karma


Depending on what information / insights you're looking for, there might be certain info needed from forwarders, in order to put the right data in the right indexes to make the Apps work as designed.
SplunkForwarder can collect metrics / stats from Windows, Linux, etc. that are often not easily attainable via syslog (See About forwarding and receiving).

How many syslog sources are you sending through your rsyslog, and what OS are they?
If you aren't sure how to track any possible trends related to where the malformed log entries, then setting up Deployment and installing forwarders instead of syslog could definitely help you clean up your data (format errors), as well as provide additional data to bring the apps to life.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...