topic Re: Splunk forwarder read file content using sftp protocol in Deployment Architecture https://community.splunk.com/t5/Deployment-Architecture/Splunk-forwarder-read-file-content-using-sftp-protocol/m-p/363487#M13391 <P>You could also use SSHFS, which would allow you to mount the remote share and then have the forwarder monitor those files.</P> <P><A href="https://github.com/libfuse/sshfs">https://github.com/libfuse/sshfs</A></P> Wed, 17 Jan 2018 17:10:55 GMT simon_branton_h 2018-01-17T17:10:55Z Splunk forwarder read file content using sftp protocol https://community.splunk.com/t5/Deployment-Architecture/Splunk-forwarder-read-file-content-using-sftp-protocol/m-p/363485#M13389 <P>Hi all,<BR /> is it possible to configure Splunk forwarder to read a log file using sftp protocol?<BR /> I have a log file on a remote server and the only way to access to this file is sftp connection.<BR /> If does make sense.</P> <P>Regards</P> Wed, 15 Mar 2017 14:00:14 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-forwarder-read-file-content-using-sftp-protocol/m-p/363485#M13389 massit 2017-03-15T14:00:14Z Re: Splunk forwarder read file content using sftp protocol https://community.splunk.com/t5/Deployment-Architecture/Splunk-forwarder-read-file-content-using-sftp-protocol/m-p/363486#M13390 <P>The UF itself does not have that capability. You should pull the file back where it can be picked up, do something on the remote end to send to http event collector or some other means of transferring the data. </P> Thu, 16 Mar 2017 03:22:22 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-forwarder-read-file-content-using-sftp-protocol/m-p/363486#M13390 starcher 2017-03-16T03:22:22Z Re: Splunk forwarder read file content using sftp protocol https://community.splunk.com/t5/Deployment-Architecture/Splunk-forwarder-read-file-content-using-sftp-protocol/m-p/363487#M13391 <P>You could also use SSHFS, which would allow you to mount the remote share and then have the forwarder monitor those files.</P> <P><A href="https://github.com/libfuse/sshfs">https://github.com/libfuse/sshfs</A></P> Wed, 17 Jan 2018 17:10:55 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-forwarder-read-file-content-using-sftp-protocol/m-p/363487#M13391 simon_branton_h 2018-01-17T17:10:55Z