Configure SC4S to send syslog data to DSP

To get syslog data from Splunk Connect for Syslog (SC4S) into a data pipeline in the , you must configure your SC4S instance to send the data to DSP. You can then use the Splunk DSP Firehose source function to get this syslog data into a DSP pipeline.

Prerequisites

Before you can use SC4S as a data source, you must have a DSP HTTP Event Collector (HEC) token for allowing SC4S to send data to DSP. See Create and manage DSP HEC tokens through the Splunk Cloud Services CLI for more information. You'll need the <token> value that gets returned when the token is created.

Make sure that the SC4S disk buffer configuration is correctly set up to minimize the number of lost events if the connection to DSP is temporarily unavailable. See Data Resilience - Local Disk Buffer Configuration and SC4S Disk Buffer Configuration for more information on SC4S disk buffering.

Steps

1. To configure your SC4S instance to use your DSP HEC token, set the following environment variables:
   • Set SPLUNK_HEC_URL to https://<DSP_HOST>, where <DSP_HOST> is the IP address of your DSP controller node.
   • Set SPLUNK_HEC_TOKEN to the DSP HEC token value. This is the <token> value that gets returned when you create the token using the instructions in Create and manage DSP HEC tokens through the Splunk Cloud Services CLI.
2. Restart your SC4S workflow.

SC4S starts sending syslog data to DSP. You can now use SC4S as a data source by creating a pipeline that starts with the Splunk DSP Firehose source function. For instructions on how to build a data pipeline, see the Building a pipeline chapter in the Use the Data Stream Processor manual. For information about the source function, see Get data from Splunk DSP Firehose in the Function Reference manual.