What is the process on the Splunk side to index syslogs through UDP?

[pavanae]

Can anyone please explain the steps to taken on the Splunk side to get the syslogs through UDP?

After configuring the syslogs with port 1024 through UDP, where can we see the logs?

And how can Splunk receive syslogs without the help of a Splunk Universal Forwarder?

[MuS · Accepted solution]

Hi pavanae,

• see the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/SyslogTCP for a step by step guide.
• Since you already added the udp input; did you specify an index? If not search on index=main which is the default index.
• Splunk can receive syslog directly over UDP or TCP, see first point on this list.

Hope this helps ...

cheers, MuS