All Apps and Add-ons

Is it possible to set up and use the Splunk Add-on for Unix and Linux without a forwarder?

seanquilty
New Member

Is it possible to setup and use the Splunk Add-on for *Nix, and splunk_TA_Nix, without having to actually install the forwarder on the *Nix servers?

Right now, all of them are configured to just forward logs to Splunk via rsyslog configuration. This allows me to do search and reporting on logs, but I'd like to be able to leverage the built-in dashboards and reporting on the Add-on.

0 Karma
1 Solution

guilmxm
SplunkTrust
SplunkTrust

Hi,

If you are still interested by a Universal Forwarder less deployment, I have worked on this with rsyslog / syslog-ng for the Nmon Performance application:

Regards,

Guilhem

View solution in original post

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi,

If you are still interested by a Universal Forwarder less deployment, I have worked on this with rsyslog / syslog-ng for the Nmon Performance application:

Regards,

Guilhem

View solution in original post

0 Karma

tmerry
Explorer

Technically, the answer to your question is yes. However, given what I think you are trying to accomplish, the answer is no.

There are actually two pieces to the puzzle - the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux. The App is driven by data generated by the Add-on and cannot be used independently. The Add-on provides a bunch of different things, including a set of scripted inputs that are described under "How it works" on the documentation page: http://docs.splunk.com/Documentation/UnixApp/5.1.0/User/AbouttheSplunkAppforUnix

In order to gather this data from a *nix host, you'll need to install a forwarder on it with the add-on. Once this data is flowing into Splunk, you will be able to install the Splunk App for Unix and Linux onto your Splunk server to get the dashboards. I'm not aware of any syslog event data that powers any component of the app. Additionally, the add-on itself does not provide any dashboards itself.

Going back to my original "yes" answer - the add-on can be deployed by itself just on your Splunk server and will help to make some of your syslog events more useful from a Splunk search perspective (e.g. field extractions, tagging, etc). If you deploy the app as well, you will populate the dashbaords, however, it will just be with data for the Splunk server itself.

Hope this is helpful!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.