syslog-ng syslog conf splunk

splunk.conf

@version: 3.5.6

# Typically placed as /etc/syslog-ng/conf.d/splunk.conf

options {
    create-dirs(yes);

    owner("splunk");
    group("splunk");
    dir-owner("splunk");
    dir-group("splunk");
    dir-perm(0755);
    perm(0644);

    time-reopen(10);
    keep-hostname(yes);
    log-msg-size(65536);

    ts_format(rfc3339);
    frac-digits(3);
};

source s_default {
    udp(ip("0.0.0.0") port(514));
    tcp(ip("0.0.0.0") port(514)); 
};

destination d_default { 
    file("/home/splunk/syslog-ng/$HOST/$YEAR-$MONTH-$DAY.log"); 
};

log { 
     source(s_default);
     destination(d_default);
};