Monitoring Splunk

Splunk doubt

palkar
Observer

Hi Team,

 

Thanks for your reply..!!

 

My question was:

 

I am having F5 waf device and we have done configured on f5 waf for sending logs to syslog server (which is splunk) with port 514.

Now I want to know, if my device sending logs to splunk(syslog) then which type of forward is my waf device. In this case my waf will be UF or HF or else?

 

Regards,

Suraj

Labels (1)
Tags (1)
0 Karma

gcusello
Legend

Hi @palkar,

as you can read at https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Monitornetworkports you can use Universal or Heavy Forwarders to take syslogs.

I prefer to use HFs because you can use the UI to configure your ingestion.

You can use the statndard syslog ingestion Feature that Splunk offer by deault, or (better) I hint to use the Splunk Connect for syslog (https://splunkbase.splunk.com/app/4740/#/overview), a Splunk free dedicated App.

Ciao.

Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!