Hi @jejohnson, Fortinet Fortigate sends its logs using syslog, so you have two choices: use a Universal Forwarder with a syslog server (betyer solution), Use an Heavy Forwarder (doesn't need a sy...
See more...
Hi @jejohnson, Fortinet Fortigate sends its logs using syslog, so you have two choices: use a Universal Forwarder with a syslog server (betyer solution), Use an Heavy Forwarder (doesn't need a syslog server). Using the first solutin you should configure a very little machine (also 2/4 CPUs and 4/8 GB RAM) with Linux and an rsyslog (or syslog-ng) server that writes the received syslogs in text files. Then you can use the Universal Forwarder to read the files and send them to the Indexers. In the UF, you have to install also the Fortinet Fortigate Add-On for Splunk (https://splunkbase.splunk.com/app/2846) to parse the logs. This Add-On must also be installed on the Search Heads and eventually also on intermediate Heavy Forwarders (if present). Plus: This solution requires a less performant server and permits to write logs even if the Splunk UF is down. Minus: Requires manual configurations of the rsyslog and the UF. The second solution, it's easier to configure because you can do everything bu GUI, but requires a more performant server (at least 8/12 CPUs and 8/12 GB RAM). This solution is prefeable if you already have an Heavy Forwarder. In the HF, you have to install also the Fortinet Fortigate Add-On for Splunk (https://splunkbase.splunk.com/app/2846) to parse the logs. The Add-On must also be installed on the Search Heads and eventually also on intermediate Heavy Forwarders (if present). Plus: easier to implement. Minus: it requires a more performant server and doesn't ingest logs when Splunk is down. In both the solutions, it's better to have two receivers and a Load Balancer to avoid a Single Point of Failure in case of maintenance or fail of the server- Ciao. Giuseppe