Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have running centralized syslog server (rsyslog on CentOS6, which works perfect). Next step it was to add Splunk as a syslog analyzing tool. All was installed perfectly - Splunk works, can log in to the front end and add data source (TCP port 514) but from there I don't see any data indexed by Splunk.

rysylog config for data storage and processing looks like:

$ModLoad ommysql
$ModLoad ommysql
*.* :ommysql:,rsysdb,rsyslog,password
*.* @@localhost

Any clue why Splunk is not receiving any data?


share|improve this question

migrated from Sep 10 '13 at 18:29

This question came from our site for information security professionals.

It is very difficult to predict what is wrong with your setup. Most probably you did not configure the data source properly. – AdnanG Sep 10 '13 at 12:55
While Splunk can often be used in the place of a SIEM or for security operations it is not necessarily a security tool. You may find more expertise in this tool at our sister site for Information Technology Professionals Server Fault. – Scott Pack Sep 10 '13 at 13:29
@ScottPack thanks for pointing me to the proper site – JackTheKnife Sep 11 '13 at 19:38
up vote 1 down vote accepted

Well, got issue resolved by using local IP instead a domain 'localhost' so line for syslog forwarding to Splunk (TCP connection) looks like

*.* @@

as is on the same server as rsyslog. Splunk is set to listen to TCP port 514 data set as syslog.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.