Splunk Search

Splunk Standalone forward data to syslog

mpuchalski
Observer

We have a relatively small Splunk implementation - just 1 standalone server. We're downloading Cisco Umbrella logs from the Cisco-managed S3 Bucket for reporting purposes.

We now have the need to also forward those umbrella logs to a syslog server in addition to leaving them on the standalone for reporting. Is there a way to configure a standalone to forward to a syslog server?

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mpuchalski,

Please read this https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Sysl... it can be configured on any Splunk instance. Just a word of caution: if you configure forwarding to a third party receiver and the receiving end goes down or is not available you will get in trouble on your Splunk instance.

Hope this helps ...

cheers, MuS

0 Karma

mpuchalski
Observer

With this standalone instance, I have multiple apps receiving data.  I only want 1 index to fwd to an external syslog server.  Is that possible without a heavy forwarder?

0 Karma

mpuchalski
Observer

Thank you. What is the trouble that Splunk will experience is the receiver is not available?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...