Getting Data In

How to send logs from a Kiwi syslog server to Splunk?

rishabhey2016
Explorer

How to integrate Kiwi syslog server with Splunk? I mean what configuration changes are required to perform on the kiwi syslog server end.

0 Karma

rishabhey2016
Explorer

Thanks Jeremiah,

While all these links tell about installing a forwarder, we can directly use the feature in our kiwi syslog to forward logs to our splunk on any of the TCP port, which we can later configure in our splunk as well.

0 Karma

Jeremiah
Motivator

I wouldn't recommend that solution. You'd have to create multiple ports if you want to classify the data differently. With the forwarder that's easy, just create multiple monitor stanzas. The forwarder handles failures much better as well. A bare TCP listener won't properly handle loadbalancing across multiple Splunk servers nor will it gracefully handle connection failures.

jplumsdaine22
Influencer

`+ 1 to Jeremiah's comment.

Use the Force[warder] Luke!

0 Karma

Jeremiah
Motivator

This has been addressed several times, take a look at:

https://answers.splunk.com/answers/290158/how-do-i-send-data-from-kiwi-syslog-to-a-splunk-in.html
https://answers.splunk.com/answers/80134/what-is-the-easiest-way-to-get-data-from-a-kiwi-syslog-serv...

You may not need to change anything if your Kiwi server is currently writing to files with parseable timestamps. Just point Splunk at the files and you should be set.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...