Deployment Architecture

How to get data into Splunk without a universal forwarder

rob_gibson
Path Finder

I have an on-prem splunk enterprise installation, consisting exclusively of Universal forwarders and a single Indexer.

We now have a cloud-hosted environment, that it restricted, as it is hosted by an external company.  They do not allow us to install any software (but their own) on the servers.

Is there any way to get data into my Indexer, without a forwarder?

Without a forwarder, am I able to apply allow/deny lists to events?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @marnall ,

the solution depends on two factors:

1) the type of server:

if it's a Linux Server, you can use a syslog or (as @marnall sais, an HEC.

If Windows is a little more difficoult because you cannot use syslog; you could use WMI, even if I don't like it.

2) the type of logs you have to ingest (operative system, application)?

If application, maybe it has a sislog sending monitoring feature and you can use it.

Ciao.

Giuseppe

0 Karma

marnall
Motivator

Does the cloud-hosted environment have any kind of log export functionality? It may be possible to configure it to send logs to the Splunk HTTP Event Collector.

Or, instead of pushing the logs, you can pull the logs using an API if it is offered by your cloud-hosted environment.

0 Karma

rob_gibson
Path Finder

Does the HEC support allow/deny for specific event types?  We have a LOT of data that we do not want to capture/forward from the cloud.

0 Karma

marnall
Motivator

That isn't specifically a HEC functionality, but Splunk can be configured with props and transforms to discard unwanted data by sending it to the nullQueue before indexing. This will consume network bandwidth from sending the data from the cloud to splunk, but will not count the discarded logs against your Splunk license.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...