I had a EC2 syslog client and a MacOS which installed the Splunk Enterprise. I want my Splunk Enterprise to be my syslog server. In that way, I should configure my syslog client to transfer syslog to Splunk Enterprise and nothing syslog server configure stuff need I make. On Splunk server I created a UDP Data Input. I also exposed 514 port and specified an Index for this Data Input. I set SourceType as 'syslog'. On syslog client side, I configured the destination to be *.* <Splunk Enterprise IP>:514 in its rsyslog.conf file. I tried to use logger to generate syslog on my client side e.g. logger -p local0.crit "...", but there was no event showing up in my index when I did the search. Basically, in my understanding the Splunk Enterprise Server can function as a syslog server which can receive message from syslog clients.  (Screenshot is from:  https://www.youtube.com/watch?v=BQU-bsSCXhk) Is there any step I did incorrect or do I miss any step?      ... View more