A Splunk technology add-on (TA) to collect and parse WireGuard logs.
On forwarders, the TA ingests and parses WireGuard debug log events.
WireGuard kernel log events written to systemd-journald or to a syslog file at /var/log/wireguard are indexed.
On the search head, the TA parses those events at search time and adds various metadata fields.
The TA requires a Linux operating system.
The instructions (in Splunkbase) assume that systemd, journald and rsyslog are used on the monitored distribution.
As of version TA-wg v1.0.0, journald is the preferred ingestion vector.
Splunk version 9.1+ is required for [journald://] inputs.
If your distribution does not use systemd or uses a version of Splunk prior to 9.1, check the installation instructions for more information.
The TA was developed by Frank Wayne.
Contact the developer with questions, bug reports or change requests. You can also refer or contribute to the GitHub repository.