https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349016#M12974 <P>We recently purchased the managed splunk cloud instance, I am in the process of adding data. We would like to index our db2diag logs which are sitting on the Linux servers. I went though the process of installing the forwarder and forwarder credentials. Now I am at a loss on how to tell the forwarder what logs to forward to splunk? With the managed splunk cloud instance, you can't do it through the Add Data button. I do have the monitoring console app, and I see the new Linux forwarder there. But I don't see an option there to manipulate the forwarder in any way. Do I have to configure the forwarder inputs on the Linux server?</P> <P>Also when I look at the monitoring console app, I see the universal forwarder and the heavy forwarder there. But we only installed universal. Is that am installation default?</P> Wed, 18 Apr 2018 17:23:58 GMT Dijanad 2018-04-18T17:23:58Z https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349016#M12974 <P>We recently purchased the managed splunk cloud instance, I am in the process of adding data. We would like to index our db2diag logs which are sitting on the Linux servers. I went though the process of installing the forwarder and forwarder credentials. Now I am at a loss on how to tell the forwarder what logs to forward to splunk? With the managed splunk cloud instance, you can't do it through the Add Data button. I do have the monitoring console app, and I see the new Linux forwarder there. But I don't see an option there to manipulate the forwarder in any way. Do I have to configure the forwarder inputs on the Linux server?</P> <P>Also when I look at the monitoring console app, I see the universal forwarder and the heavy forwarder there. But we only installed universal. Is that am installation default?</P> Wed, 18 Apr 2018 17:23:58 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349016#M12974 Dijanad 2018-04-18T17:23:58Z https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349017#M12975 <P>This may help:</P> <P><A href="http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Forwarding/Aboutforwardingandreceivingdata">http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Forwarding/Aboutforwardingandreceivingdata</A></P> <P><A href="http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Data/Monitorfilesanddirectorieswithinputs.conf">http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Data/Monitorfilesanddirectorieswithinputs.conf</A></P> <P>You have to write inputs.conf on the forwarder.</P> Thu, 19 Apr 2018 05:50:28 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349017#M12975 p_gurav 2018-04-19T05:50:28Z https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349018#M12976 <P>The inputs.conf That has to be written on the unix server. There isn't a gui to manage forwarders?</P> Thu, 19 Apr 2018 12:54:13 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349018#M12976 Dijanad 2018-04-19T12:54:13Z https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349019#M12977 <P>So we have splunk cloud. So that seems to work different. What I see is that you have to use splunk web to configure forwarders for the cloud version. Is that correct?</P> Thu, 19 Apr 2018 13:28:12 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-forward-data-logs-from-Linux-to-Splunk/m-p/349019#M12977 Dijanad 2018-04-19T13:28:12Z