So, I just figured out that customer do not connect any DB to Splunk using DBConnect. They just use Database native log -> Universal forwarder -> Splunk. Your doubt is valid why not use directly from native but now that I see they do not connect their DB to Splunk and just forward the logs, they can configure UF in such a way it can send us logs along with Splunk. ... View more

I did connect MySQL to Splunk using DBConnect but not on the Universal Forwarder, i do not know how I can connect a DB on UF. Also, I am still figuring out how I can send the audit logs for connected DB using Universal Forwarder ... View more

I apologize for the confusion. I am trying to send the data to a third-party application (not a Splunk database). Currently, I am working to connect various databases to Splunk, as the customer already has databases connected. My goal is to forward the audit logs from each database which is connected to Splunk to our system. We are using Logstash to receive the data, but since Logstash does not have a Splunk input plugin, I am attempting to use TCP to receive data and send it from the Universal Forwarder to a TCP port, which can be set to 514. The architecture looks like this: Splunk (with databases) -> Universal Forwarder -> Logstash -> Analysis. ... View more

  Hi John, We are not using Splunk directly, but we are developing a tool for a customer who does. The customer has data sources connected to Splunk, and they want to forward the audit logs from these data sources using the Universal Forwarder. We're trying to figure out how to forward these audit logs to Logstash, either via TCP or Filebeat. Do you have any suggestions on how to achieve this? I’ve managed to receive syslog data on my local laptop using the Universal Forwarder with the following outputs.conf:     [tcpout] [tcpout:fastlane] server = 127.0.0.1:514 sendCookedData = false      I’ve also connected MySQL to Splunk using DB Connect to test it out, but I’m not receiving any MySQL logs. ... View more

Thank you for your response. I’m limited to using the Universal Forwarder (UF) only. From various resources, I’ve learned that UF can send raw data, which works for me. I’ve successfully set up Logstash to receive syslog data from my Mac using the TCP input plugin. I’m now wondering how I can configure it to receive data based on the Source or SourceType. Alternatively, is there a way to send all data to Logstash in real-time? ... View more

Sorry, i am new to Splunk. Yes, I have only being able to connect mySql to DBConnect but i am not able to configure it to logstash. Any idea how can i get the audit logs on logstash  though TCP? UF can forward the log to TCP and logstash has a input plugin for TCP. ... View more