topic Re: Collecting server logs without installing Splunk UF? in Getting Data In

Collecting server logs without installing Splunk UF?

karthi2809 — Fri, 14 Jun 2024 10:04:41 GMT

Hi ,

How to collect server logs without installing the Splunk Universal forwarder. Because the server owned team is not interested to install UF. Please let me know is any other way to collect the data and how?

Thanks,

Karthi

Re: Collecting server logs without installing Splunk UF?

gcusello — Fri, 14 Jun 2024 13:18:18 GMT

Hi @karthi2809 ,

are you speking of a Windows or a Linux server?

if Windows you can use WMI : https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

if Linux, you can use syslogs: https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

Even if Universal Forwarder is much more efficient anf doesn't give any issue and very trascurable load on the machine.

Ciao.

Giuseppe

Re: Collecting server logs without installing Splunk UF?

karthi2809 — Wed, 19 Jun 2024 11:41:54 GMT

Hi @gcusello

I agree that point but our client is not intrested to install agent and as you mentioned the syslog the application team have multiple logs .So is there any ways to monitor the logs .And how to onboard syslogs any examples.

Thanks,

Karthi

Re: Collecting server logs without installing Splunk UF?

gcusello — Wed, 19 Jun 2024 12:22:15 GMT

Hi @karthi2809 ,

Linux servers can easily send syslogs, that you can receive directly in Splunk or passing throgh rsyslog or syslog-ng server.

Anyway I continue to hint to try to convince your customer about Universal Forwarders: they are more efficient, secure and you can capture more kinds of logs..

Ciao.

Giuseppe