topic How to feed Splunk with remote custom input? in Getting Data In

How to feed Splunk with remote custom input?

mxmauro — Thu, 07 Aug 2014 18:31:47 GMT

Hi,

I want to create an app to feed a Splunk server with my custom data. I saw in C# sdk I can build a ModularInput application and install it on the main server.

But I don't understand how to do the same on remote machines. I installed the universal forwarder in another computer to begin my tests but don't know:

How to link my app with the universal forwarder or create an app to directly feed a remote server.
How to start my app installed on a remote computer from the main server.

Thanks,
Mauro.

Re: How to feed Splunk with remote custom input?

strive — Mon, 28 Sep 2020 17:17:34 GMT

Assuming you can reach your remote machine from the main server, here you go

You can create an app that gets deployed on universal forwarder and takes care of log forwarding. You can use deployment server to deploy app on your other machine.
In the forwarder app that you have created, you need to configure inputs.conf and outputs.conf to monitor and to forward logs respectively.
To deploy apps on other systems you need to configure serverclass.conf

The following are the links that will help you with all the configurations that you need to do

Deploy Apps to clients - http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Updateconfigurations
Deployment Server and Forwarder Management - http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Aboutdeploymentserver

Getting data in using forwarders - http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/Usingforwardingagents
Wiki link with many topics - http://wiki.splunk.com/Community:Getting_data_into_Splunk

If you have already tried some of these then post your configurations. Splunkers will help you.

Re: How to feed Splunk with remote custom input?

mxmauro — Fri, 08 Aug 2014 15:04:13 GMT

Hi Strive, do you have any sdk documentation about how to link a modularinput app to the universal forwared, if it is really needed?

Re: How to feed Splunk with remote custom input?

strive — Fri, 08 Aug 2014 15:16:38 GMT

http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Definedeploymentclasses

http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Useserverclass.conf

http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Serverclassconf