topic With splunkd behind a firewall, S3 and sshfs work to access logs, but can a Splunk forwarder collect logs in redis? in Getting Data In

With splunkd behind a firewall, S3 and sshfs work to access logs, but can a Splunk forwarder collect logs in redis?

92607547 — Mon, 20 Apr 2015 16:00:48 GMT

Hi.

Currently, splunk indexer works behind firewall, and it must stay behind firewall. Now I am using S3 and sshfs when I need to access logs. Does splunk have solution in its toolbox that allows forwarders collect logs in redis, for example, and the indexer will connect to redis and read all these logs? Firewall is a oneway service in my case, the indexer can see forwarders and redis, but not vice versa. I just want to have one more data input except sshfs and S3.

Thank you.

Re: With splunkd behind a firewall, S3 and sshfs work to access logs, but can a Splunk forwarder collect logs in redis?

92607547 — Mon, 20 Apr 2015 16:35:44 GMT

pablo splunk" edit the topic and I don't agree how he changed it.
I used radis just as an example. There can be anything else instead of redis. I am looking for any solution that helps me to index data pulled by indexer but not forwarded to indexer.

Now I can use script which will pull data from DB. But scripts look like workaround in this case.

Re: With splunkd behind a firewall, S3 and sshfs work to access logs, but can a Splunk forwarder collect logs in redis?

acharlieh — Mon, 20 Apr 2015 17:40:22 GMT

I have not used either of these solutions extensively personally so YMMV but Hunk is a solution for Splunk to query data that at rest lives in NoSQL Data Stores. (It was built for Hadoop, but supposedly could be modified for any to query from any NoSQL system). There is also DBConnect which allows you to query various RDBMS either at search time, or polling for indexing data into Splunk.

I have not seen a solution for getting data into these data stores however.