Splunk doubt

[palkar]

Hi Team,

Thanks for your reply..!!

My question was:

I am having F5 waf device and we have done configured on f5 waf for sending logs to syslog server (which is splunk) with port 514.

Now I want to know, if my device sending logs to splunk(syslog) then which type of forward is my waf device. In this case my waf will be UF or HF or else?

Regards,

Suraj

[gcusello]

Hi @palkar,

as you can read at https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Monitornetworkports you can use Universal or Heavy Forwarders to take syslogs.

I prefer to use HFs because you can use the UI to configure your ingestion.

You can use the statndard syslog ingestion Feature that Splunk offer by deault, or (better) I hint to use the Splunk Connect for syslog (https://splunkbase.splunk.com/app/4740/#/overview), a Splunk free dedicated App.

Ciao.

Giuseppe