I've been reading quite a bit on syslog collection via a Splunk Universal Forwarder. In particular answer #28680.https://answers.splunk.com/answers/28680/index.html I understand the reasons behind using SUF or another syslog collector as opposed to sending to Splunk directly. I haven't, however, been able to figure out how to perform an approach such as:
syslog device (rsyslog - linux client) -> SUF -> Splunk
Can someone point me in the right direction?
I apologize if this question has been answered before, but my google-fu isn't helping me.
Your devices send syslog events to the rsyslog server. Rsyslog writes the events to disk. SUF monitors said disk file(s) and forwards the events to Splunk. Does that help?
I see. Makes sense. I was under the impression SUF could act as sort of a relay, and I would be able to just point to it. That being said, is there a sample config (inputs/outouts.conf) for SUF on how to deal locally stored rsyslog files?
Try this, but make sure to change the monitor path to point to your log file location, change the index and sourcetype
[monitor:///opt/log/www*/access.log] index=web sourcetype=access_combined
[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = Indexer1:9997,Indexer2:9997