Connecting syslog data sources to your DSP pipeline
When creating a data pipeline in the , you can get syslog data into your pipeline by routing the data to a Splunk Connect for Syslog (SC4S) instance and then connecting to the SC4S instance as a data source. You can get syslog data into a pipeline, transform the data as needed, and then send the transformed data out from the pipeline to a destination of your choosing.
See Splunk Connect for Syslog for more information about SC4S.
To connect to SC4S as a data source, you must complete the following tasks:
- Configure your SC4S instance to send syslog data to DSP. You'll need to generate a DSP HTTP Event Collector (HEC) token and configure your SC4S instance to use it. See Configure SC4S to send syslog data to DSP.
- Create a pipeline that starts with the Splunk DSP Firehose source function.
When you activate the pipeline, the source function starts collecting the syslog data that is being routed to the SC4S instance.
Set the default field values in DSP HEC
Configure SC4S to send syslog data to DSP
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02