[syslog-ng] Sending json logs with syslog-ng to Splunk via HEC

[Carlos Lopez]

Hi all,

I am trying to configure syslog-ng to send events in json format to our internal Splunk (free version) server.

Searching info regarding how to accomplish this config, I see these entries in Balabit’s blog:

https://www.syslog-ng.com/community/b/blog/posts/optimize-your-splunk-infrastructure-using-new-syslog-ng-features 

https://www.syslog-ng.com/community/b/blog/posts/sending-logs-splunk-http

Are these entries accurate to accomplish this config? Somebody can share any sample?

I am using syslog-ng’ OSS under FreeBSD 13.1 hosts …

Best regards,
C. L. Martinez