Is it possible to set up and use the Splunk Add-on for Unix and Linux without a forwarder?

[seanquilty]

Is it possible to setup and use the Splunk Add-on for *Nix, and splunk_TA_Nix, without having to actually install the forwarder on the *Nix servers?

Right now, all of them are configured to just forward logs to Splunk via rsyslog configuration. This allows me to do search and reporting on logs, but I'd like to be able to leverage the built-in dashboards and reporting on the Add-on.

[guilmxm · Accepted solution]

Hi,

If you are still interested by a Universal Forwarder less deployment, I have worked on this with rsyslog / syslog-ng for the Nmon Performance application:

• http://nmon-for-splunk.readthedocs.io/en/latest/rsyslog_deployment.html
• http://nmon-for-splunk.readthedocs.io/en/latest/syslogng_deployment.html

Regards,

Guilhem

[tmerry]

Technically, the answer to your question is yes. However, given what I think you are trying to accomplish, the answer is no.

There are actually two pieces to the puzzle - the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux. The App is driven by data generated by the Add-on and cannot be used independently. The Add-on provides a bunch of different things, including a set of scripted inputs that are described under "How it works" on the documentation page: http://docs.splunk.com/Documentation/UnixApp/5.1.0/User/AbouttheSplunkAppforUnix

In order to gather this data from a *nix host, you'll need to install a forwarder on it with the add-on. Once this data is flowing into Splunk, you will be able to install the Splunk App for Unix and Linux onto your Splunk server to get the dashboards. I'm not aware of any syslog event data that powers any component of the app. Additionally, the add-on itself does not provide any dashboards itself.

Going back to my original "yes" answer - the add-on can be deployed by itself just on your Splunk server and will help to make some of your syslog events more useful from a Splunk search perspective (e.g. field extractions, tagging, etc). If you deploy the app as well, you will populate the dashbaords, however, it will just be with data for the Splunk server itself.

Hope this is helpful!