Deployment Architecture

How to get data into Splunk without a universal forwarder

rob_gibson
Path Finder

I have an on-prem splunk enterprise installation, consisting exclusively of Universal forwarders and a single Indexer.

We now have a cloud-hosted environment, that it restricted, as it is hosted by an external company.  They do not allow us to install any software (but their own) on the servers.

Is there any way to get data into my Indexer, without a forwarder?

Without a forwarder, am I able to apply allow/deny lists to events?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @marnall ,

the solution depends on two factors:

1) the type of server:

if it's a Linux Server, you can use a syslog or (as @marnall sais, an HEC.

If Windows is a little more difficoult because you cannot use syslog; you could use WMI, even if I don't like it.

2) the type of logs you have to ingest (operative system, application)?

If application, maybe it has a sislog sending monitoring feature and you can use it.

Ciao.

Giuseppe

0 Karma

marnall
Motivator

Does the cloud-hosted environment have any kind of log export functionality? It may be possible to configure it to send logs to the Splunk HTTP Event Collector.

Or, instead of pushing the logs, you can pull the logs using an API if it is offered by your cloud-hosted environment.

0 Karma

rob_gibson
Path Finder

Does the HEC support allow/deny for specific event types?  We have a LOT of data that we do not want to capture/forward from the cloud.

0 Karma

marnall
Motivator

That isn't specifically a HEC functionality, but Splunk can be configured with props and transforms to discard unwanted data by sending it to the nullQueue before indexing. This will consume network bandwidth from sending the data from the cloud to splunk, but will not count the discarded logs against your Splunk license.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...