Apigee Splunk Logs Problem

[rssabandal]

Hi,

I'm trying to push logs in splunk via TCP Syslog.The flow is Apigee > NGINX > Splunk. Here's the policy configuration:

Here's the configuration in nginx:

The logs still doesn't appear in Splunk. Any ideas on why it doesn't appear on Splunk?

Regards,

Ryan

[dchiesa1 · Accepted solution]

I don't have a good idea.

To diagnose, I would check these things

1. network connectivity between the Apigee MP and nginx. I suppose you are using a "customer managed" (OPDK) version of Apigee. That means you manage thenetwork and the firewalls. Can the MP actually connect to port 514 of the nginx server? You can try this with telnet from the MP VM.
2. logging at nginx. Turn on access logging and check to see if you are seeing any transactions.
3. The format of the message you are sending . The content of {splunkLogs}. I have seen misformatted messages be rejected by Splunk; nothing shows in the splunk log.
4. Your query in the Splunk UI. Make sure you are checking in the right place for the log messages.

[rssabandal]

Hi. Thanks for your time. Logs is actually enabled in nginx. If there are logs being sent from Apigee to NGINX, will it appear in the logs?

[dchiesa1]

I am no nginx expert, but as far as I know, if you have stream logging enabled in nginx, then yes, you should see log entries in the nginx logs, resulting from the TCP syslog messages that Apigee sends to the nginx-managed port.

[#5]

nginx logs will be available in the routers log directory. You can install the Splunk universal forwarder on the router and send the logs to splunk application.