topic Re: Hiow to forward events from servers and network devices in Getting Data In

Hiow to forward events from servers and network devices

ppram — Fri, 01 Apr 2011 14:14:32 GMT

We have a splunk Indexer based on Linux and we have around 40+ servers and network devices in our network.

Want to know how to get all these servers and network devices forward SYSlogs and event logs to the splunk Indexer.

Do I have to install a splunk agent in all the servers? If Yes, what is a Splunk Agent? How do I tell the network devices to send the SYSlog and SNMP logs to Splunk Indexer?

Re: Hiow to forward events from servers and network devices

MuS — Fri, 01 Apr 2011 18:50:45 GMT

Hello ppram

best thing to do, read the manual http://www.splunk.com/base/Documentation/latest/Data/WhatSplunkcanmonitor and I think all your questions will be answered.

regards, MuS

Re: Hiow to forward events from servers and network devices

ppram — Mon, 04 Apr 2011 22:01:48 GMT

HI MuS,

Thanks for helping me on this. Now for example if I have a windows server I want to collect all the windows event logs and send it to the Splunk Indexer in another server.

I need to install the splunk in that Windows server and then install the windows APP and forward the log to the Splunk Indexer server?

Please correct me if I am wrong.

Re: Hiow to forward events from servers and network devices

MuS — Tue, 05 Apr 2011 12:23:28 GMT

Hi ppram

yes, install a light weight forwarder or as from 4.2 on, an universal forwarder on that windows server, configure it as needed and your done.