Thanks @gcusello  I was able to fix the issue. Apart from the fact that 3rd part needs syslog forwarding as you mentioned, the issue was the default protocol. Splunk has it as UDP. Thanks ... View more

Hi @gcusello , I see, That was a big gap on my end. But I also already had tried the Syslog Forwarding section on the URL you shared. I was not able to receive any data at the syslog server. My output.conf file is as simple as below.   [syslog] defaultGroup=syslogGroup [syslog:syslogGroup] server = 192.168.6.158:514   I initially felt that the syslog server configuration might have some issue or maybe network, but no I was able to send TCP message to the syslog server from the Splunk Enterprise VM Instance. Only the data from Splunk is not getting forwarded. Both the Sysylog Server VM and Splunk Enterprise VM are in the same network. Just curious, is the defaultGroup parameter got to do something here?   Thanks for your help. ... View more