I am new to Splunk and am attempting to forward Splunk WMIEventLog:Security to syslog_ng with a backend MYSQL. This is a requirement for our log archives. I can setup a forwarder to Forward Splunk data via TCP, but the message Field is blank.
Can anyone assit me with How to Forward Splunk WMIEventLog:Security data to syslog_ng with a backend MYSQL?
asked 16 Feb '12, 14:01
The following configuration is for a heavy forwarder on the windows box, it will forward your Windows Security event log in syslog format to the syslog_ng server you define in the outputs.conf.
I'm assuming you already have the syslog-ng backend configured to push the data into your mysql database, but if not those directions can be found here: http://sqls.net/wiki/howto:syslog-ng_to_mysql