SPLK-2002: Splunk Enterprise Certified ArchitectDemo

Question

A new Splunk customer uses syslog to collect data from network devices on port 514. What is the best practice for ingesting this data into Splunk?

A Configure syslog to send the data to multiple Splunk indexers.
B Use a Splunk indexer to collect a network input on port 514 directly.
C Use a Splunk forwarder to collect the input on port 514 and forward the data.
D Configure syslog to write logs and use a Splunk forwarder to collect the logs.

Explanation

The Splunk best practice for syslog is to let a dedicated syslog daemon (syslog-ng, rsyslog, or Splunk Connect for Syslog) receive traffic on port 514 and write it to files, then install a universal forwarder to monitor those files and forward the data over TCP 9997 (D). Having Splunk itself listen directly on UDP/TCP 514 (B, C) is discouraged: UDP does not guarantee delivery, binding to a port below 1024 typically requires running as root, and any Splunk restart drops in-flight syslog with no on-disk buffer. Writing to files first decouples ingestion from Splunk availability and preserves data across restarts.

Learn more

SPLK-2002: Splunk Enterprise Certified ArchitectDemo

AstroTutor

Notes

Readiness

QuestionQ63

Community Discussion