Getting Data In

What is the easiest way to get data from a Kiwi Syslog server into Splunk?

kforr74
Explorer

We have two Kiwi Syslog servers and we would like to migrate the existing data flow from the Kiwi Syslog servers over to Splunk. What is the best way to do this? Thank you.

Tags (1)
0 Karma

andykiely
Path Finder

I use a log to file action on the kiwi syslog server (I filter into various files) and then use a Universal Forwarder to send the files to splunk.

Regards
Andy

starcher
Influencer

I agree with Andy. Best practice is collect syslog at something like Kiwi, syslog-ng then use a universal forwarder to pickup. That way you can assign index, sourcetype etc to the files you pick up especially when they differ in groups you want to give log access back to in splunk (by index).

0 Karma

riqbal
Communicator

hi @starcher,

I am forwarding logs from sophos to central syslog server. the logs are getting save in /central/%hostname% location.
I install the universal forwarder on syslog server and also install the sophos add on SH.

Now what should I put input.conf and output.conf.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Developer Program!

Hey Splunk community!  We are excited to announce that Splunk is launching the Splunk Developer Program in ...

Splunkbase Year in Review 2024

Reflecting on 2024, it’s clear that innovation and collaboration have defined the journey for Splunk ...

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...