All Apps and Add-ons

Apache Webs Server to splunk

jadengoho
Builder

Here's the situation, I have an Apache Webserver on my VirtualMachine. And have a splunk web on my localhost on my computer.

What I want to try to get the acccess.log that resides on Virtual machine. Cause in the documentation it only works on the same network, how about if it in different networks, how can I get logs from apache webserver.

Tags (1)
0 Karma
1 Solution

splunker12er
Motivator

On your web-server you might need to install splunk universal forwarder and setup inputs.conf ( to monitor the log files) and outputs.conf ( destination you are going to forward the logs)

you mentioned splunk-web running in your localhost (where you have install splunk Enterprise in your localhost and splunk service is running in your localhost , which is your indexer/destination that you are going to forward logs to your localhost.

access.log( virtual machines) [Install splunk universal forwarder] ---> splunk indexer/search head( localhost)
(inputs.conf, outputs.conf) ---> setup splunk to listen on some tcp ports (e..g tcp/9997) to receive the logs from your VM.

Consider firewalls inbetween , you need to allow required ports

View solution in original post

0 Karma

splunker12er
Motivator

On your web-server you might need to install splunk universal forwarder and setup inputs.conf ( to monitor the log files) and outputs.conf ( destination you are going to forward the logs)

you mentioned splunk-web running in your localhost (where you have install splunk Enterprise in your localhost and splunk service is running in your localhost , which is your indexer/destination that you are going to forward logs to your localhost.

access.log( virtual machines) [Install splunk universal forwarder] ---> splunk indexer/search head( localhost)
(inputs.conf, outputs.conf) ---> setup splunk to listen on some tcp ports (e..g tcp/9997) to receive the logs from your VM.

Consider firewalls inbetween , you need to allow required ports

0 Karma

jadengoho
Builder

I would try this recommendation , Thanks a lot .

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...