topic Re: Connect IP network to splunk in Getting Data In

Connect IP network to splunk

maximus — Fri, 27 Nov 2020 15:54:06 GMT

How do i start by connecting 2 of my network IP to splunk/

I would like to view the system activities and predicative maintenance for any HDD failure?

Thank you

Re: Connect IP network to splunk

richgalloway — Sat, 28 Nov 2020 01:17:47 GMT

" system activities and predictive maintenance" are pretty broad topics. Please be more specific about your goals. What platform are you monitoring? Can you install a universal forwarder on it? What data do you need to predict a HDD failure?

Re: Connect IP network to splunk

maximus — Sat, 28 Nov 2020 05:52:11 GMT

I'm very new to the splunk system. As my company wanted to move to splunk to monitor all their system in splunk.

1. Yes i have install forwarder in my Linux.

2. I'm monitoring the HDD failure.

3. If possible to view all system into 1 splunk monitor console.

Thank you.

Re: Connect IP network to splunk

richgalloway — Sat, 28 Nov 2020 21:41:02 GMT

That still doesn't give me enough to work with.

You have installed a forwarder on your system. Is that forwarder successfully sending data to Splunk?

What problems would you like to solve with Splunk?

You say to want to detect HDD failures and are monitoring for them. Since I don't know how you're doing that monitoring I can only offer general suggestions. Search your indexes ("main" is the most likely one) for whatever string indicates an HDD failure. Something like this:

index=main "HDD failure detected"

Re: Connect IP network to splunk

maximus — Sun, 29 Nov 2020 18:06:45 GMT

Maybe we start from the beginning.

1. How do i view my network server with given IP?

2. Can i set an alert to my connected server via IP input?

Thank you

Re: Connect IP network to splunk

maximus — Fri, 04 Dec 2020 02:07:39 GMT

First of all how do i get my network server to be connected to the splunk?

Re: Connect IP network to splunk

richgalloway — Fri, 04 Dec 2020 13:57:09 GMT

There are a few ways to do that.

Install a universal forwarder on the server.
Have the server send events through a syslog server to Splunk.
Have the server send events to Splunk's HTTP Event Collector.

There are other ways to get data into Splunk, but they probably don't apply.

See https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Getstartedwithgettingdatain for more information.