https://community.splunk.com/t5/Getting-Data-In/How-to-collect-FTP-and-SFTP-activity-on-servers-via-Splunk/m-p/315678#M59070 <P>Your most flexible option is to use <CODE>stream</CODE>:</P> <P><A href="https://splunkbase.splunk.com/app/1809/">https://splunkbase.splunk.com/app/1809/</A></P> Tue, 23 May 2017 17:15:50 GMT woodcock 2017-05-23T17:15:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-collect-FTP-and-SFTP-activity-on-servers-via-Splunk/m-p/315677#M59069 <P>We would like to gather information on inbound and outbound ftp and secure ftp connections made to our servers from within our intranet. The message should be logged on the server logs. I need to know how I can query Splunk to pickup this information.</P> <P>Note: This is not related to sending the log files into Splunk using FTP. All searches I have done thus far are just related to the topic of moving log files to Splunk using ftp.</P> Tue, 23 May 2017 17:05:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-collect-FTP-and-SFTP-activity-on-servers-via-Splunk/m-p/315677#M59069 eboyd 2017-05-23T17:05:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-collect-FTP-and-SFTP-activity-on-servers-via-Splunk/m-p/315678#M59070 <P>Your most flexible option is to use <CODE>stream</CODE>:</P> <P><A href="https://splunkbase.splunk.com/app/1809/">https://splunkbase.splunk.com/app/1809/</A></P> Tue, 23 May 2017 17:15:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-collect-FTP-and-SFTP-activity-on-servers-via-Splunk/m-p/315678#M59070 woodcock 2017-05-23T17:15:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-collect-FTP-and-SFTP-activity-on-servers-via-Splunk/m-p/315679#M59071 <P>If the logs are on the ftp server, can you just install the universal forwarder to send them to splunk?</P> Tue, 23 May 2017 17:34:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-collect-FTP-and-SFTP-activity-on-servers-via-Splunk/m-p/315679#M59071 myriadic 2017-05-23T17:34:02Z