Apache Webs Server to splunk

[jadengoho]

Here's the situation, I have an Apache Webserver on my VirtualMachine. And have a splunk web on my localhost on my computer.

What I want to try to get the acccess.log that resides on Virtual machine. Cause in the documentation it only works on the same network, how about if it in different networks, how can I get logs from apache webserver.

[splunker12er · Accepted solution]

On your web-server you might need to install splunk universal forwarder and setup inputs.conf ( to monitor the log files) and outputs.conf ( destination you are going to forward the logs)

you mentioned splunk-web running in your localhost (where you have install splunk Enterprise in your localhost and splunk service is running in your localhost , which is your indexer/destination that you are going to forward logs to your localhost.

access.log( virtual machines) [Install splunk universal forwarder] ---> splunk indexer/search head( localhost)
(inputs.conf, outputs.conf) ---> setup splunk to listen on some tcp ports (e..g tcp/9997) to receive the logs from your VM.

Consider firewalls inbetween , you need to allow required ports

[jadengoho]

I would try this recommendation , Thanks a lot .