Send Local Logs to Splunk

Scenario: you want to save gateway/relay logs to a Splunk Indexer. This guide presents a simple method to send all gateway/relay logs to a Splunk Indexer.

Setting up the export

1. Enable relay logging in the Admin UI under Settings / Log Encryption & Storage. Ensure logging is set to FILE.

2. Configure your indexer to receive the date from the forwarder:

   

   

   
3. Create an index for StrongDM, called "sdm_index" in this example:

   

   

   
4. Install the forwarder, then configure the monitor.

   Copy

   wget -O splunkforwarder-8.1.3-63079c59e632-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.1.3&product=universalforwarder&filename=splunkforwarder-8.1.3-63079c59e632-linux-2.6-x86_64.rpm&wget=true'
   sudo rpm -ihv splunkforwarder-8.1.3-63079c59e632-linux-2.6-x86_64.rpm
   export PATH=$PATH:/opt/splunkforwarder/bin
   splunk start

5. You can search for "sdm_index" on the indexer's search.