Getting Data In

Collect remote files using SFTP

npr72
New Member

Hi all,

Is there any native way of configuring splunk or forwarders to periodically collect files using SFTP ?

It seems that it does not exist but I'm very surprised.

Am I wrong ?

Thanks in advance

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You could write a scripted input that does the SFTP for you.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jkat54
SplunkTrust
SplunkTrust

There’s an app that makes splunk into an ftp server for receiving files... not sure if that helps.

https://splunkbase.splunk.com/app/3318/

But yeah I’d make a scripted input as Rich suggested. The scripted input would download the files to a staging area and then I’d use a monitor stanza input to monitor the staging area and index files that are arriving. The stdout of the scripted input would be logged to help you find errors with the script too

0 Karma

FrankVl
Ultra Champion

Not that I'm aware of. So you would either need to create a modular input for that on the splunk side, or script on the source side to push the logs to the splunk box.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...