Archive
Highlighted

Collect remote files using SFTP

New Member

Hi all,

Is there any native way of configuring splunk or forwarders to periodically collect files using SFTP ?

It seems that it does not exist but I'm very surprised.

Am I wrong ?

Thanks in advance

Tags (1)
0 Karma
Highlighted

Re: Collect remote files using SFTP

Ultra Champion

Not that I'm aware of. So you would either need to create a modular input for that on the splunk side, or script on the source side to push the logs to the splunk box.

0 Karma
Highlighted

Re: Collect remote files using SFTP

SplunkTrust
SplunkTrust

You could write a scripted input that does the SFTP for you.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Collect remote files using SFTP

SplunkTrust
SplunkTrust

There’s an app that makes splunk into an ftp server for receiving files... not sure if that helps.

https://splunkbase.splunk.com/app/3318/

But yeah I’d make a scripted input as Rich suggested. The scripted input would download the files to a staging area and then I’d use a monitor stanza input to monitor the staging area and index files that are arriving. The stdout of the scripted input would be logged to help you find errors with the script too

0 Karma