topic Re: Multiple server logs indexing in Getting Data In

Multiple server logs indexing

ganeshgs — Mon, 14 Jan 2013 02:50:58 GMT

Hello,

We have our application in multiple servers, we need to index the log files.

two options to do that.

1) Using forwarder/receiver - do we need to install forwarder to all server or is there any way we can achieve this.
2) Using Shell script – coping the logs files to destination and indexing in SPLUNK.

Thanks,

Re: Multiple server logs indexing

lguinn2 — Mon, 14 Jan 2013 07:03:40 GMT

I would install the forwarder on all the servers. It will be easier than using a shell script, and work better.

Re: Multiple server logs indexing

pioneer817 — Mon, 14 Jan 2013 07:10:56 GMT

(spam removed)

Re: Multiple server logs indexing

ganeshgs — Mon, 14 Jan 2013 07:33:32 GMT

But we run application on 21 servers on Load Balancing.
we are checking for any possibility in splunk to connect from receiver to other servers through SSH, like Putty.
By this way we can directly point to individual server log files through "Data Inputs >> files and directories" option and make splunk to listen to this logs and continuously collect data.

Thanks,

Re: Multiple server logs indexing

e82than — Mon, 14 Jan 2013 07:54:55 GMT

I concur Lisa's suggestion. Using the forwarder will be useful when deploying in large enterprises. If you do not use scripted inputs, it will also allow business continuity. You can further use a deployment server, to manage it when you have too many forwarders to look at.

Re: Multiple server logs indexing

martin_mueller — Mon, 14 Jan 2013 08:17:04 GMT

You can make the forwarders point to individual server log files as well. For a large number of forwarders you can use the deployment server to roll out any configuration changes to similar forwarders in one go.

Re: Multiple server logs indexing

ganeshgs — Mon, 14 Jan 2013 08:32:17 GMT

One quick clarification. I guess even deployment server also suggest to install splunk instance in each servers.
So what if we hosted our application in cloud environment and have limited access to servers.