I have running centralized syslog server (rsyslog on CentOS6, which works perfect). Next step it was to add Splunk as a syslog analyzing tool. All was installed perfectly - Splunk works, can log in to the front end and add data source (TCP port 514) but from there I don't see any data indexed by Splunk.
rysylog config for data storage and processing looks like:
$ModLoad ommysql $ModLoad ommysql *.* :ommysql:127.0.0.1,rsysdb,rsyslog,password *.* @@localhost
Any clue why Splunk is not receiving any data?