Getting Data In

Syslog Data Reaching Forwarder?

itsmevic
Communicator

Hello, I need to check to see if Syslog data is reaching my forwarders.  What would be the best query to use to check this?

Labels (1)
1 Solution

General_Talos
Path Finder

As per my understanding for syslog server logs monitoring, you have to install a Splunk UF agent on syslog server and perform "file & folder monitoring" (to the logs which you want to onboard into Splunk).

Within input.conf you define logs details like

index = XYZ
sourcetype= ABC

 

 

if your logs are reporting to Splunk, you can check it by

 

| tstats count where index=ZYX sourcetype=ABC by sourcetype _time 
|timechart sum(count) as count by sourcetype

View solution in original post

General_Talos
Path Finder

As per my understanding for syslog server logs monitoring, you have to install a Splunk UF agent on syslog server and perform "file & folder monitoring" (to the logs which you want to onboard into Splunk).

Within input.conf you define logs details like

index = XYZ
sourcetype= ABC

 

 

if your logs are reporting to Splunk, you can check it by

 

| tstats count where index=ZYX sourcetype=ABC by sourcetype _time 
|timechart sum(count) as count by sourcetype

View solution in original post

gcusello
Legend

Hi @itsmevic,

you can run a simple search on the index where you store the logs that you ingest with that input from your syslog.

You can recognize them using the host field.

in other words:

index=your_index host=your_host

Ciao.

Giuseppe

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!