---
title: "Splunk Connect for Syslog (SC4S)"
url: "https://axoflow.com/docs/axoflow/0.86/provisioning/sc4s/"
last_modified: "2026-05-15T15:12:45+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt).

# Splunk Connect for Syslog (SC4S)

Onboarding allows you to collect metrics about the host, display the host on the **Topology** page, and to tap into the log flow.

Onboarding requires you to modify the host and the configuration of the logging agent (SC4S) running on the host.

- Level 1: Install Axolet on the host where SC4S is running. Axolet collects metrics from the host and sends them to the AxoConsole, so you can check host-level metrics on the **Metrics & Health** page of the host, and displays the host on the **Topology** page.
- Level 2: Instrument the configuration of the logging agent to provide detailed metrics about the traffic flow. This allows you to display data about the host on the **Analytics** page.
- Level 3: Instrument the configuration of the logging agent to allow you to access the logs of the logging agent and to [tap into the log flow from the AxoConsole](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/log-tapping/index.md). The exact steps for this integration depend on the configuration of your logging agent. We provide basic instrumentation instructions for getting started in this guide, but we strongly recommend to [contact us so our professional services can help you with a production integration](https://axoflow.com/contact).

To generate metrics for the Axoflow platform from an existing [Splunk Connect for Syslog (SC4S)](https://splunk.github.io/splunk-connect-for-syslog/main/) instance, you need to configure SC4S to generate these metrics. Complete the following steps.

1. If you haven’t already done so, [install Axolet on the host](https://axoflow.com/docs/axoflow/0.86/provisioning/axorouter/linux/index.md), then approve its registration on the **Provisioning** page of the AxoConsole.
2. Download the following code snippet as `axoflow-instrumentation.conf`.

   ```shell
   @define allow-config-dups 1

   block parser classifier-parser() {
     metrics-probe(
       key("classified_events_total")
       labels(
         "app" => "${.splunk.sourcetype}"
         "host" => "${HOST}"
         "program" => "${.splunk.source}"
         "source" => "${SOURCE}"
       )
     );
   };

   @module confgen context(root) name(dest_hec) exec("`SC4S_ETC`/conf.d/destinations/dest_hec/plugin.py | sed -e '/^destination d_hec/a\    channel { parser { classifier-parser(); }; destination {' -e '/^};/i\ };};'  ")
   dest_hec()

   @define allow-config-dups 0
   ```
3. If you are running SC4S under podman or docker, copy the file into the `/opt/sc4s/local/config/destinations` directory. In other deployment methods this might be different, check the SC4S documentation for details.
4. Check if the metrics are appearing, for example, run the following command on the SC4S host:

   ```shell
   syslog-ng-ctl stats prometheus | grep classified
   ```
5. If SC4S is sending data to an AxoRouter, create a placeholder [data forwarding rule](https://axoflow.com/docs/axoflow/0.86/data-sources/data-forwarding/index.md) where the **Edge Selector** matches SC4S and the **Router connector** is the connector of the AxoRouter instance where SC4S is sending the data. This is needed to display SC4S and its data metrics on the **Topology** page, AxoConsole won’t manage SC4S.