I want to you splunk forwarder to send apache-logs to syslog
i made config:
/opt/splunkforwarder/etc/system/local
inputs.conf
[default]
host = my_hostname
outputs.conf
[syslog]
defaultGroup=syslogGroup
[syslog:my_syslog_group]
server = IP:514
props.conf
[host::cpanel*]
TRANSFORMS-cpanel = send_to_syslog
[source::/usr/local/apache/domlogs/logfile]
transforms.conf
[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group
i restart splunk
/opt/splunkforwarder/bin/splunk restart
and nothing happened (it don't send any information)
and in logs, i can't see source files
... View more