Splunk® Data Stream Processor

Connect to Data Sources and Destinations with DSP

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Connecting syslog data sources to your DSP pipeline

When creating a data pipeline in the , you can get syslog data into your pipeline by routing the data to a Splunk Connect for Syslog (SC4S) instance and then connecting to the SC4S instance as a data source. You can get syslog data into a pipeline, transform the data as needed, and then send the transformed data out from the pipeline to a destination of your choosing.

See Splunk Connect for Syslog for more information about SC4S.

To connect to SC4S as a data source, you must complete the following tasks:

  1. Configure your SC4S instance to send syslog data to DSP. You'll need to generate a DSP HTTP Event Collector (HEC) token and configure your SC4S instance to use it. See Configure SC4S to send syslog data to DSP.
  2. Create a pipeline that starts with the Splunk DSP Firehose source function.

When you activate the pipeline, the source function starts collecting the syslog data that is being routed to the SC4S instance.

Last modified on 18 December, 2020
Set the default field values in DSP HEC
Configure SC4S to send syslog data to DSP

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters