is it possible to use file monitoring on external server that doesnt have splunk or forwarder?

[splunkt0n]

Hi All,

Would like to ask if it is possible to monitor files outside the server without using a forwarder. Thank you in advance.

[splunkt0n]

Hi nickhillscpl,

how about if the servers are in two different networks?

[nickhills · Accepted solution]

I presume you mean without using a forwarder "on that" system?

Two approaches immediately spring to mind:
1.) Map/Mount the remote filesystem onto a suitable host which is running the forwarder
2.) Script or otherwise schedule log shipping from your target server to your forwarder and process them as if they were local logs.

In both cases you can override the hostname so that the logs get attributed to the correct server

There are pros and cons to each, but will depend on your use case.

[splunkt0n]

thank you for that answer nickhillscpl. how about if the servers are in different network? what we're trying to achieve is that we monitor the logs on a specific server on a different network without installing a forwarder.

[nickhills]

what access do you have to these servers? are they windows or linux?