topic Re: Forward logs from multiple Linux servers in Deployment Architecture

Forward logs from multiple Linux servers

kkossery — Thu, 09 Jan 2014 15:16:24 GMT

Experts,

We have a enterprise product running on Red Hat Linux running on about 40 servers and want to forward logs from a non-standard location quickly and efficiently. I know we can use Splunk Forwarder to push logs out. Is there a way to pull logs from splunk rather than push from the clients. I'm looking for a way out where we don't have individually log in to each system and install the forwarder.

Thank you.

Re: Forward logs from multiple Linux servers

MuS — Thu, 09 Jan 2014 15:25:05 GMT

Hi kkossery,

No, Splunk does not support pull method for remote logs out of box ..... but you could do it in different ways:

rsync the logs from the indexer and read the files from there
NFS mount the source files and index them from there

Anyhow, best way to do it, is using the universal forwarder and forward logs to the indexer.

hope this helps ...

cheers, MuS

Re: Forward logs from multiple Linux servers

kkossery — Thu, 09 Jan 2014 15:28:09 GMT

Thank you. I guess I'll have to do the hard way of deploying the agent on all my systems.

Re: Forward logs from multiple Linux servers

MuS — Thu, 09 Jan 2014 15:31:31 GMT

you can use puppet to install the universal forwarder - the lesser 'hard way' 😉