Forward logs from multiple Linux servers

[kkossery]

Experts,

We have a enterprise product running on Red Hat Linux running on about 40 servers and want to forward logs from a non-standard location quickly and efficiently. I know we can use Splunk Forwarder to push logs out. Is there a way to pull logs from splunk rather than push from the clients. I'm looking for a way out where we don't have individually log in to each system and install the forwarder.

Thank you.

[MuS]

Hi kkossery,

No, Splunk does not support pull method for remote logs out of box ..... but you could do it in different ways:

• rsync the logs from the indexer and read the files from there
• NFS mount the source files and index them from there

Anyhow, best way to do it, is using the universal forwarder and forward logs to the indexer.

hope this helps ...

cheers, MuS

[MuS]

you can use puppet to install the universal forwarder - the lesser 'hard way' 😉

[kkossery]

Thank you. I guess I'll have to do the hard way of deploying the agent on all my systems.