topic How do you get all Splunk cluster servers internal Linux log files indexed? in Deployment Architecture

How do you get all Splunk cluster servers internal Linux log files indexed?

evets — Mon, 03 Dec 2018 08:10:05 GMT

We have a requirement to forward all the log files from /var/log internal linux OS on the Splunk Enterprise cluster to a security app the same as all the other linux servers in the system, this includes the Search Heads, Indexers, Distribution and Master Node. Installing a universal forwarder is apparently not recommended.

What would be the best way to implement this?

Re: How do you get all Splunk cluster servers internal Linux log files indexed?

harsmarvania57 — Mon, 03 Dec 2018 09:45:54 GMT

Hi @evets,

You can implement same monitoring stanza on Splunk Enterprise servers which you are running on UF to monitor all Linux servers, if you have dedicated app on UF to monitor /var/log/ then you can implement same app on Splunk Enterprise Server.

Re: How do you get all Splunk cluster servers internal Linux log files indexed?

tom_frotscher — Mon, 03 Dec 2018 09:47:45 GMT

Hi,

why is it not recommended to use Universal Forwarders?

From my point of view you should use Universal Forwarders. Every instance which already have Splunk installed (SH, Indexers,...) can also act as a forwarder, just add the configuration in the outputs.conf.

Alternativly, you could use something like syslog, send all data to a syslog server and collect them from there with a Universal Forwarder.

Greetings

Tom

Re: How do you get all Splunk cluster servers internal Linux log files indexed?

evets — Tue, 04 Dec 2018 00:00:17 GMT

Thanks for your swift replies guys, I will see it it can be pushed out via the deployment server.