There are three types of Splunk Fowarders: Universal, Heavy, and Light. The only forwarder that supports SYSLOG is a Heavy Forwarder.
The following links provide data on forwarding data from Splunk:
Validate that logs were being forwarded to the Comm Broker Sender by running this tcpdump command:
tcpdump port 514 host <IP address of Splunk Server/Fowarder> -A
The Splunk GUI may flash a message saying that forwarding has stopped due to a spike in event volume. The message also may say there is a lack of open files or memory. In the event Splunk stops forwarding data and starts dropping events, do the following:
Modify the memory setting on the Splunk server in one of the following locations:
/etc/security/limits.conf/etc/security/limits.d/90-nproc.conf(Red Hat)
Add these parameters to the file:
soft nproc 10240hard nproc 10240soft nofile 65536hard nofile 65536
Reboot the server.
Clear all the stale queries.
Add the following to the splunk
output.conffile:sendCookedData = falseNote
After each step, restart Splunk.
Clear all the stale queries.
Add the following to the splunk
output.conffile:sendCookedData = falseNote
After each step, restart Splunk.