Here is an example of syslog-ng configuration that stores the data on disk for Splunk to read. You will need to manage the data's retention with something like logrotate. https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html Here is an example that uses syslog-ng and HEC, where no data is stored on the syslog server. https://www.splunk.com/en_us/blog/tips-and-tricks/syslog-ng-and-hec-scalable-aggregated-data-collection-in-splunk.html You could also use the Splunk App for Syslog (SC4S) https://splunkbase.splunk.com/app/4740/ https://splunk.github.io/splunk-connect-for-syslog/main/   ... View more