Connecting syslog data sources to your DSP pipeline

When creating a data pipeline in the , you can get syslog data into your pipeline by routing the data to a Splunk Connect for Syslog (SC4S) instance and then connecting to the SC4S instance as a data source. You can get syslog data into a pipeline, transform the data as needed, and then send the transformed data out from the pipeline to a destination of your choosing.

See Splunk Connect for Syslog for more information about SC4S.

To connect to SC4S as a data source, you must complete the following tasks:

1. Configure your SC4S instance to send syslog data to DSP. You'll need to generate a DSP HTTP Event Collector (HEC) token and configure your SC4S instance to use it. See Configure SC4S to send syslog data to DSP.
2. Create a pipeline that starts with the Splunk DSP Firehose source function.
   • See the Building a pipeline chapter in the Use the Data Stream Processor manual for instructions on how to build a data pipeline.
   • See Get data from Splunk DSP Firehose in the Function Reference manual for more information about the source function.

When you activate the pipeline, the source function starts collecting the syslog data that is being routed to the SC4S instance.