README

Splunk Connect for Syslog is an open source packaged solution for getting data into Splunk using syslog-ng (OSE) and the Splunk HTTP event Collector.

Purpose

Splunk Connect for Syslog (SC4S) is a community project focused on reducing the pain of getting syslog data sources into Splunk. The primary pain points SC4S addresses include the following…

• Shortage of deep syslog expertise in the community
• Inconsistency between syslog server deployments creates a support challenge
• Data sources tagged with catch-all sourcetype “syslog” which limits Splunk analytics
• Uneven data distribution between Splunk indexers impacts search performance
• Splunk Connect for Syslog should be used by any Splunk customer needing to onboard data sources via syslog to Splunk.

Usage

For full usage instructions, please visit the Splunk Connect for Syslog documentation.

Support

Splunk Connect for Syslog is an open source product developed by Splunkers with contributions from the community of partners and customers. This unique product will be enhanced, maintained and supported by the community in addition to Splunk Support entitlements, led by Splunkers with deep subject matter expertise. The primary reason why Splunk is taking this approach is to push product development closer to those that use and depend upon it. This direct connection will help us all be more successful and move at a rapid pace.

Post a question to Splunk Answers using the tag "Splunk Connect For Syslog"

Join the #splunk-connect-for-syslog room in the splunk-usergroups Slack Workspace. If you don't yet have an account sign up

Please use the GitHub issue tracker to submit bugs or request enhancements: https://github.com/splunk/splunk-connect-for-syslog/issues

Get involved, try it out, ask questions, contribute filters, and make new friends!

Contributing

We welcome feedback and contributions from the community! Please see our contribution guidelines for more information on how to get involved. PR contributions require acceptance of both the code of conduct and the contributor license agreement.

This repository uses pre-commit. After installing dependencies, please do

pre-commit install

License

• Configuration and documentation licensed subject to CC0

• Code and scripts licensed subject to BSD-2-Clause

• Third Party Red Hat Universal Base Image see License

• Third Party Syslog-NG (OSE) License