All Apps and Add-ons

Apache Webs Server to splunk

jadengoho
Builder

Here's the situation, I have an Apache Webserver on my VirtualMachine. And have a splunk web on my localhost on my computer.

What I want to try to get the acccess.log that resides on Virtual machine. Cause in the documentation it only works on the same network, how about if it in different networks, how can I get logs from apache webserver.

Tags (1)
0 Karma
1 Solution

splunker12er
Motivator

On your web-server you might need to install splunk universal forwarder and setup inputs.conf ( to monitor the log files) and outputs.conf ( destination you are going to forward the logs)

you mentioned splunk-web running in your localhost (where you have install splunk Enterprise in your localhost and splunk service is running in your localhost , which is your indexer/destination that you are going to forward logs to your localhost.

access.log( virtual machines) [Install splunk universal forwarder] ---> splunk indexer/search head( localhost)
(inputs.conf, outputs.conf) ---> setup splunk to listen on some tcp ports (e..g tcp/9997) to receive the logs from your VM.

Consider firewalls inbetween , you need to allow required ports

View solution in original post

0 Karma

splunker12er
Motivator

On your web-server you might need to install splunk universal forwarder and setup inputs.conf ( to monitor the log files) and outputs.conf ( destination you are going to forward the logs)

you mentioned splunk-web running in your localhost (where you have install splunk Enterprise in your localhost and splunk service is running in your localhost , which is your indexer/destination that you are going to forward logs to your localhost.

access.log( virtual machines) [Install splunk universal forwarder] ---> splunk indexer/search head( localhost)
(inputs.conf, outputs.conf) ---> setup splunk to listen on some tcp ports (e..g tcp/9997) to receive the logs from your VM.

Consider firewalls inbetween , you need to allow required ports

0 Karma

jadengoho
Builder

I would try this recommendation , Thanks a lot .

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...