syslog-ng to HEC data persistence

splunk_zen · ‎04-19-2019

How would we ensure data persistence/queuing when using Ryan Faircloth's (or a similar script) method to batch the syslog messages using a script rather than the default one message per POST of syslog-ng's http() output ?

Scenario is if there's an 1h network outage between syslog-ng and the HEC HWFs

https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/

hendrick · ‎04-19-2019

Take a look at the native splunk-hec() driver in recent versions of syslog-ng PE.
https://support.oneidentity.com/syslog-ng-premium-edition/7.0.13/technical-documents

Batching and load balancing are built in now.

syslog-ng to HEC data persistence

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

syslog-ng to HEC data persistence

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future