topic Re: forward txt files or data from window server using splunk forwarder to remote server in Getting Data In

How to forward txt files or data from window server using Splunk forwarder to remote server?

anilkapoor123 — Thu, 20 Jul 2023 16:54:49 GMT

Hi Team,

i want to check whether is it feasible to send data or txt files exist in a folder using splunk forwarder to remote system or syslog server

please suggest me steps to do it

Re: forward txt files or data from window server using splunk forwarder to remote server

PickleRick — Fri, 14 Jul 2023 13:05:05 GMT

While it is possible on Heavy Forwarder (syslog output is not available on UF), it doesn't make much sense. There are several syslog daemons for windows.

Also, using Splunk server this way might not be exactly permitted by the license, especially if you don't use Splunk in your environment otherwise.

Re: forward txt files or data from window server using splunk forwarder to remote server

anilkapoor123 — Tue, 18 Jul 2023 07:14:54 GMT

@PickleRick ,

you mean with heavyforwarder it is possible to fwd txt logs files exist in folder . if it is possible

please share me the configurations file for inputs.conf and outputs.conf whatever needed to send data to syslog server

Re: forward txt files or data from window server using splunk forwarder to remote server

anilkapoor123 — Thu, 20 Jul 2023 15:44:06 GMT

@PickleRick

query.

i am able to forward iis logs from window server using splunk forwarder to heavy forwarder [ splunk forwarder --> Heavy forwarder --> syslog remote server

but heavy forwarder not able to send logs or data to syslog server .

is there any way to check whether it is sending data or not from HF to syslog server

please share the configuration at HF end to send data to syslog server

specifically that props.conf , transforms.conf , outputs.conf

any setting needed for inputs.conf as well at HF end ?

Re: forward txt files or data from window server using splunk forwarder to remote server

PickleRick — Thu, 20 Jul 2023 17:02:54 GMT

Yes, there is a way to check whether your HF is sending to syslog server. Just do a tcpdump/wireshark and see if there is data flowing over the wire to your syslog destination.

What is your configuration? What have _you_ tried so far to make the forwarding to syslog work?

And why do you insist on using Splunk components for something that doesn't have much to do with Splunk at all.