Getting Data In

spoof source IP when sending syslog to 3rd party syslog server

Explorer

Hi all,
As described in the title, I need to forward syslog event log to other server.
However, I am getting the same source IP for the all event log.
Is there any way to maintain the source IP when forwarding events to 3rd party server or SIEM?
Please advise me.

regards,
Joseph Woo

Tags (3)
1 Solution

Legend

No, this cannot be done using Splunk. It's generally best practice to use a separate syslog daemon for receiving syslog and having Splunk read the files it creates. That way you can solve the particular problem you have, and you're also more free to perform maintenance on Splunk without having to worry about losing syslog data. See more (and similar) information here: http://answers.splunk.com/answers/1513/is-there-a-way-to-maintain-the-source-ip-of-the-udp-syslog-pa...

View solution in original post

0 Karma

Legend

No, this cannot be done using Splunk. It's generally best practice to use a separate syslog daemon for receiving syslog and having Splunk read the files it creates. That way you can solve the particular problem you have, and you're also more free to perform maintenance on Splunk without having to worry about losing syslog data. See more (and similar) information here: http://answers.splunk.com/answers/1513/is-there-a-way-to-maintain-the-source-ip-of-the-udp-syslog-pa...

View solution in original post

0 Karma

Explorer

BTW, I forgot to mention that this is a Windows Event log.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!