This section describes how to forward messages from syslog-ng Store Box (SSB) to Splunk.
From version 6.6.0, SSB uses the syslog-ng Premium Edition (syslog-ng PE) application's support to post messages to a Splunk deployment in JSON format, using the HTTP Event Collector (HEC) over HTTP and Secure HTTP (HTTPS).
For further details about how the application forwards messages to Splunk, see splunk-hec: Sending messages to Splunk HTTP Event Collector in the syslog-ng PE Administration Guide.
This section describes the prerequisites for forwarding messages from syslog-ng Store Box (SSB) to Splunk.
You must enable HTTP Event Collector (HEC).
You must create a token for SSB.
NOTE: One Identity recommends that you use the default syslog source type for the token.
For details about enabling HEC and creating a token on your Splunk deployment, see Set up and use HTTP Event Collector in Splunk Web.
If you want to use Peer verification for your Splunk destination, consider that the CA certificate must be added under Log > Options > TLS settings before you enable Peer verification under Log > Destination > <your-splunk-destination> > Transport > HTTPS connection settings > Verification.
This section describes the limitations for forwarding messages from syslog-ng Store Box (SSB) to Splunk.
Messages with HTTP 400 response code will be dropped
If the message sent to Splunk is invalid, Splunk will reply with an HTTP 400 response code.
The message can be invalid for either of these reasons:
A required argument is missing from the message.
The message size exceeds limits.
The message itself has an invalid format.
In these cases, SSB cannot successfully send the messages to Splunk. These messages would prevent SSB from sending further messages to the messaging service, therefore SSB must drop them.
IP address limitation
IPv6 addresses are not supported as HTTP Event Collector (HEC) URLs.
Proxy type limitations
Only HTTP proxy types are supported.
Authenticated proxy types are not supported.
Batch-bytes unit of measurement limitation
When configuring performance-related settings, you must enter the value of Batch-bytes in bytes.
This section describes how you can configure the transport settings (HTTP or HTTPS transport) for your Splunk destination.
To configure the transport settings for your Splunk destination
Navigate to Log > Destinations and select 
Select Splunk destination.
Figure 164: Log > Destinations > <your-splunk-destination> - Creating your new Splunk destination
Select the transport type (HTTP connection settings or HTTPS connection settings) that you want to use for your Splunk destination, then continue configuring the respective connection type settings.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center
