https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230133#M44803 <P>The only other thing I’m thinking of is sftp-ing log files off of the server and then parsing them manually, which doesn’t sound nearly as usable as the Splunk API.</P> Mon, 21 Nov 2016 14:49:59 GMT Kaushikkatta03 2016-11-21T14:49:59Z https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230131#M44801 <P>One of our Web/mobile team is considering an innovation project involving Splunk integration. Basically, better tracking/early notification of errors so that we can prevent them. We’re attempting to work with the Splunk API.</P> <P>What is the efficient way to access application logs? And moreover, where can we get sftp-ing log files and how to parse them manually?</P> Wed, 16 Nov 2016 14:18:01 GMT https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230131#M44801 Kaushikkatta03 2016-11-16T14:18:01Z https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230132#M44802 <P>What application are you referring to, Splunk or something else?</P> Wed, 16 Nov 2016 14:55:57 GMT https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230132#M44802 richgalloway 2016-11-16T14:55:57Z https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230133#M44803 <P>The only other thing I’m thinking of is sftp-ing log files off of the server and then parsing them manually, which doesn’t sound nearly as usable as the Splunk API.</P> Mon, 21 Nov 2016 14:49:59 GMT https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230133#M44803 Kaushikkatta03 2016-11-21T14:49:59Z https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230134#M44804 <P>Don't sftp if you can avoid it. It is FAR better to put a Universal Forwarder on the server where the logs are being written. If you have to use FTP, setup a Heavy Forwarder and build your own cron to pull the files in but do it atomically (copy them in with a temporary name/extension and once the files are down, rename them to what Splunk is expecting).</P> Sat, 25 Mar 2017 12:05:57 GMT https://community.splunk.com/t5/Getting-Data-In/Where-can-I-get-application-logs-regarding-Splunk-API/m-p/230134#M44804 woodcock 2017-03-25T12:05:57Z