Dashboards & Visualizations

How to read application log file from remote server in Splunk dashboard

ronak
Path Finder

Setup

  • Splunk 6.2.1
  • Data processing server - Server1 (which is on same network as Splunk servers - indexers and search heads - but physically different server)
  • dashboard that shows the status of various data processes (or jobs) by reading the meta data tables from database instance that retains the state of various data processes (these data processes populate meta data tables in database as they progress from one step to other)
  • These data processes also generate log files (text files) on Server1

Need

On the job record in my dashboard, I also want to provide the functionality such that when NOC person looks at the job record and clicks on a field "see more details", can read the log file content (log file is sitting on Server1 in /data/jobs) in a new browser window

How do I achieve it?

thanks, ronak

0 Karma

muebel
SplunkTrust
SplunkTrust

You could possibly setup a scripted input running through the forwarder on Server1 that leverages some utility to read what you want out of the database, and return the results.

An alternative maybe is to implement Splunk DB Connect : https://apps.splunk.com/app/958/

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...