Implementing Splunk 7 - Third Edition

Receiving syslog events

Another common source of data is syslog, usually from devices that have no filesystem or no support for installing software. These sources are usually devices or appliances, and usually send those events using UDP packets. Syslog management deserves a book of its own, so we will only discuss how to integrate syslog with Splunk at a high level.