topic Re: Monitoring logs on another machine without sending the data to splunk server via ftp in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Monitoring-logs-on-another-machine-without-sending-the-data-to/m-p/64683#M12992 <P>You would need to have the files available via a file based network protocol. Options for this could be:</P> <UL> <LI>nfs</LI> <LI>cifs/samba</LI> <LI>sshfs</LI> </UL> <P>To monitor a log file, Splunk needs to be able to track which items have already been indexed. Other options involve making a copy locally so that this can be tracked. These options would be:</P> <UL> <LI>As you suggested, a regular copy of log files scp/ftp etc</LI> <LI>A scripted input that accessed the file over an ssh session, and appended to a local copy that was read by Splunk.</LI> </UL> Mon, 18 Mar 2013 09:19:16 GMT datasearchninja 2013-03-18T09:19:16Z Monitoring logs on another machine without sending the data to splunk server via ftp https://community.splunk.com/t5/Getting-Data-In/Monitoring-logs-on-another-machine-without-sending-the-data-to/m-p/64682#M12991 <P>Can splunk monitor a log errors.log that exist on another machine without sending the files via ftp/sftp to splunk server and use monitor option in inputs? Is their a simplest way to monitor a distant log file? Can splunk universal forwarder perform this step and do i need to open new ports for that reason ?</P> Mon, 18 Mar 2013 08:30:16 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-logs-on-another-machine-without-sending-the-data-to/m-p/64682#M12991 royimad 2013-03-18T08:30:16Z Re: Monitoring logs on another machine without sending the data to splunk server via ftp https://community.splunk.com/t5/Getting-Data-In/Monitoring-logs-on-another-machine-without-sending-the-data-to/m-p/64683#M12992 <P>You would need to have the files available via a file based network protocol. Options for this could be:</P> <UL> <LI>nfs</LI> <LI>cifs/samba</LI> <LI>sshfs</LI> </UL> <P>To monitor a log file, Splunk needs to be able to track which items have already been indexed. Other options involve making a copy locally so that this can be tracked. These options would be:</P> <UL> <LI>As you suggested, a regular copy of log files scp/ftp etc</LI> <LI>A scripted input that accessed the file over an ssh session, and appended to a local copy that was read by Splunk.</LI> </UL> Mon, 18 Mar 2013 09:19:16 GMT https://community.splunk.com/t5/Getting-Data-In/Monitoring-logs-on-another-machine-without-sending-the-data-to/m-p/64683#M12992 datasearchninja 2013-03-18T09:19:16Z