All Apps and Add-ons

Apache Webs Server to splunk

jadengoho
Builder

Here's the situation, I have an Apache Webserver on my VirtualMachine. And have a splunk web on my localhost on my computer.

What I want to try to get the acccess.log that resides on Virtual machine. Cause in the documentation it only works on the same network, how about if it in different networks, how can I get logs from apache webserver.

Tags (1)
0 Karma
1 Solution

splunker12er
Motivator

On your web-server you might need to install splunk universal forwarder and setup inputs.conf ( to monitor the log files) and outputs.conf ( destination you are going to forward the logs)

you mentioned splunk-web running in your localhost (where you have install splunk Enterprise in your localhost and splunk service is running in your localhost , which is your indexer/destination that you are going to forward logs to your localhost.

access.log( virtual machines) [Install splunk universal forwarder] ---> splunk indexer/search head( localhost)
(inputs.conf, outputs.conf) ---> setup splunk to listen on some tcp ports (e..g tcp/9997) to receive the logs from your VM.

Consider firewalls inbetween , you need to allow required ports

View solution in original post

0 Karma

splunker12er
Motivator

On your web-server you might need to install splunk universal forwarder and setup inputs.conf ( to monitor the log files) and outputs.conf ( destination you are going to forward the logs)

you mentioned splunk-web running in your localhost (where you have install splunk Enterprise in your localhost and splunk service is running in your localhost , which is your indexer/destination that you are going to forward logs to your localhost.

access.log( virtual machines) [Install splunk universal forwarder] ---> splunk indexer/search head( localhost)
(inputs.conf, outputs.conf) ---> setup splunk to listen on some tcp ports (e..g tcp/9997) to receive the logs from your VM.

Consider firewalls inbetween , you need to allow required ports

0 Karma

jadengoho
Builder

I would try this recommendation , Thanks a lot .

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...