Configuring syslog-ng for Splunk

In this guide, we will walk through the steps to configure syslog-ng to send logs to Splunk.

Prerequisites

• A working installation of syslog-ng.
• A working installation of Splunk.

Installation Steps

1. Install syslog-ng on your server using the package manager:

   sudo apt-get install syslog-ng
   

2. Configure syslog-ng to forward logs to Splunk. Modify the configuration file located at /etc/syslog-ng/syslog-ng.conf:

   destination d_splunk {
      tcp("<SPLUNK_HOST>" port(<SPLUNK_PORT>));
   };
   log { source(s_src); destination(d_splunk); };
   

3. Restart syslog-ng:

   sudo systemctl restart syslog-ng
   

Verification

To verify that logs are being forwarded to Splunk:

• Check the Splunk logs to see if the entries from syslog-ng are being captured.