splunk stream

iherb_0718 — Tue, 02 Feb 2021 05:17:43 GMT

My servers (clients) are running splunk stream. I believe within the deployment server will contain the configurations that is telling the client what to stream (dns, dhcp, http, etc). Where can I find this within the deployment server or is it available in a conf file somewhere on the clients?

Re: splunk stream

scelikok — Tue, 02 Feb 2021 05:30:43 GMT

Hi @iherb_0718,

Splunk Stream configurations are managed by Splunk App for Stream. This should be installed on your Search Head/Heads. On this app, you can go to the "Configuration | Distributed Forwarder Management" menu setup Stream Client groups. Then start required streams from the "Configuration | Configure Streams" menu. You can see documentation below;

https://docs.splunk.com/Documentation/StreamApp/7.3.0/DeployStreamApp/DeploymentArchitecture#How_Splunk_TA_stream_communicates_with_splunk_app_stream

topic splunk stream in Splunk Search

splunk stream

Re: splunk stream