https://community.splunk.com/t5/Knowledge-Management/Splunk-on-a-read-only-file-system/m-p/66973#M7255 <P>Universal forwarder might work for this, but it would be useful to know what types of inputs you want to use. If the forwarder doesn't work you could always push the data to your splunk server using scp or something similiar (or mount your log directory from the splunk server).</P> Wed, 20 Mar 2013 03:29:33 GMT jstockamp 2013-03-20T03:29:33Z https://community.splunk.com/t5/Knowledge-Management/Splunk-on-a-read-only-file-system/m-p/66972#M7254 <P>All, </P> <P>We have an application server which has a vendor requirement to operate in read only. We can install taking in/out of read only mode. But it MUST be in read only mode to operate. Is it possible the universal forwarder can operate in this situation? </P> Wed, 20 Mar 2013 03:24:22 GMT https://community.splunk.com/t5/Knowledge-Management/Splunk-on-a-read-only-file-system/m-p/66972#M7254 daniel333 2013-03-20T03:24:22Z https://community.splunk.com/t5/Knowledge-Management/Splunk-on-a-read-only-file-system/m-p/66973#M7255 <P>Universal forwarder might work for this, but it would be useful to know what types of inputs you want to use. If the forwarder doesn't work you could always push the data to your splunk server using scp or something similiar (or mount your log directory from the splunk server).</P> Wed, 20 Mar 2013 03:29:33 GMT https://community.splunk.com/t5/Knowledge-Management/Splunk-on-a-read-only-file-system/m-p/66973#M7255 jstockamp 2013-03-20T03:29:33Z