Why collect Syslog via universal forwarder vs sending to Splunk directly?

[tfaria]

Hi all,

I've been reading quite a bit on syslog collection via a Splunk Universal Forwarder. In particular answer #28680.https://answers.splunk.com/answers/28680/index.html I understand the reasons behind using SUF or another syslog collector as opposed to sending to Splunk directly. I haven't, however, been able to figure out how to perform an approach such as:

syslog device (rsyslog - linux client) -> SUF -> Splunk

Can someone point me in the right direction?

I apologize if this question has been answered before, but my google-fu isn't helping me.

Thank you.

[richgalloway]

Your devices send syslog events to the rsyslog server. Rsyslog writes the events to disk. SUF monitors said disk file(s) and forwards the events to Splunk. Does that help?

[tfaria]

I see. Makes sense. I was under the impression SUF could act as sort of a relay, and I would be able to just point to it. That being said, is there a sample config (inputs/outouts.conf) for SUF on how to deal locally stored rsyslog files?

[skoelpin]

Try this, but make sure to change the monitor path to point to your log file location, change the index and sourcetype

inputs.conf

[monitor:///opt/log/www*/access.log]
index=web
sourcetype=access_combined

outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
disabled = false
server = Indexer1:9997,Indexer2:9997