Getting Data In

Why collect Syslog via universal forwarder vs sending to Splunk directly?


Hi all,

I've been reading quite a bit on syslog collection via a Splunk Universal Forwarder. In particular answer #28680. I understand the reasons behind using SUF or another syslog collector as opposed to sending to Splunk directly. I haven't, however, been able to figure out how to perform an approach such as:

syslog device (rsyslog - linux client) -> SUF -> Splunk

Can someone point me in the right direction?

I apologize if this question has been answered before, but my google-fu isn't helping me.

Thank you.

0 Karma


Your devices send syslog events to the rsyslog server. Rsyslog writes the events to disk. SUF monitors said disk file(s) and forwards the events to Splunk. Does that help?

If this reply helps you, Karma would be appreciated.


I see. Makes sense. I was under the impression SUF could act as sort of a relay, and I would be able to just point to it. That being said, is there a sample config (inputs/outouts.conf) for SUF on how to deal locally stored rsyslog files?

0 Karma


Try this, but make sure to change the monitor path to point to your log file location, change the index and sourcetype




defaultGroup = default-autolb-group

disabled = false
server = Indexer1:9997,Indexer2:9997
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...