Implementing Splunk 7, Third Edition - Third Edition

Using a native syslog receiver

The best practice is to use a standalone syslog receiver to write events to the disk. Examples of syslog receivers include syslog-ng or rsyslog. Splunk is then configured to monitor the directories written by the syslog receiver.

Ideally, the syslog receiver should be configured to write one file or directory per host. inputs.conf can then be configured to use host_segment or host_regex to set the value of the host. This configuration has the advantage that props.conf stanzas can be applied by host, for instance, setting TZ by hostname pattern. This is not possible if the host is parsed out of the log messages, as is commonly the case with syslog.

The advantages of a standalone process include the following: ...