Splunk Base : SplunkAdministration : #3422

Syslog in Splunk

Halah — Sun, 18 Oct 2009 00:22:18 PDT

I am running Splunk 4.0 on Windows server 2008, and there is no firewalls implemented in between. And I am using the default Admin user.

What configuration is needed to make this app retrieve syslog msg ?

Syslog in Splunk

araitz — Thu, 15 Oct 2009 07:49:45 PDT

What version of Splunk? What operating system? Is there a firewall such as iptables that is blocking traffic to port 514? What user is Splunk running as?

Syslog in Splunk

Halah — Wed, 14 Oct 2009 21:04:09 PDT

I am trying to configure Splunk as a syslog server, I created a syslog app and I tried configure it to capture packets on UDP port 514 using the input.conf file, but it didnt work.
I read about a way to make Kiwi syslog capture the syslog msgs and make Splunk monitor the log file. I tried it but still.

I doubt that the app is missconfigured coz it does not retrieve any input from the file. I think whats missing is to instruct the syslog app to graph and analyze the inputs, but how can that be done?

your help is greatly appreciated,