Hopefully, someone could guide me through this process.
Newbie here. Pllease bear with me with these lame questions. 😄
All I wanted to do is push my routers' logs pointing to the Syslog server.
Can I implement this using Splunk without a good background in programming? I know IP routing but not much on coding. I can configure all routers pointing to the syslog server.
What are the things I need to consider? From hardware to installation of splunk? What splunk should I need to subscribe if I only wanted to implement a syslog server?
Do we have a step-by-step tutorial on how do we implement this by beginners point-of-view?
Thank you so much. Appreciate someone could help me.
God bless and Keep safe guys!
Splunk has inside the function of syslog server and a dedicated app to do this: Splunk Connect for Syslog (https://splunkbase.splunk.com/app/4740/) and it isn't requested programming knowledge but a little Splunk knowledge.
To do this, at first you have to define if you want HA or not:
this is important because, as you know, you have to take syslogs when they arrive otherwise they are lost, so you need a system with two servers so at least there's always one of them active, also during failure or maintenence.
Anyway, the steps are the following (not HA):
If you want HA, it's only different the first part because you have to configure two HFs and the Load Balancer to distribute load between HFs, then you have to use the LB address as destination from your syslog sources.
if you search on Google, you can find a lot of documentation and videos about this, e.g.:
Hey, I know barely little on programming but we have four syslog servers which accept logs and forward to Splunk.
How we do it, we have a server we designate as a "syslog server" with a universal forwarder on it.
In the /etc/rsyslog.d/external.conf we have rulesets and inputs configured for the types of servers we have.
Since you will only forward logs for routers, I doubt yours would be complicated 🙂
After configuring your syslog, then you can configure the inputs.conf to monitor that directory.
The free version of Splunk should be more than enough to monitor your router's logs. So you shouldn't have to install a universal forwarder on a separate machine, and then forward that to your Splunk server.
Hope this helps, let me know if you need a little more guidance.