Some devices such as firewalls, routers, and switches do not generate logs directly; instead, they send their log and event data over network ports to, typically, a syslog server that stores the data in log files in some directory. The best practice for handling this scenario is to install a universal forwarder on the syslog server so that you can configure multiple inputs (one for each type of data) in inputs.conf to assign the appropriate index and sourcetype for each data source type. You will also need to assign a host in the inputs.conf file for each input, or do some research on how to leverage DNS to identify the proper hostname for each data source (which is outside the scope of this book). However, if you simply must stream this data from the devices directly to Splunk, there are two approaches that will work.
One approach is to send...
