Deployment Architecture

How to get remote linux log into splunk

xuanyun
Path Finder

http://docs.splunk.com/Documentation/Splunk/latest/Data/Unixlogslocal

I can't understand that.
How to Splunk monitor log from remote linux log?
Universal Forwarder have been installed in the remote linux.
What I should do then?

Tags (3)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Either by using a forwarder (which you seem to have), configuring inputs.conf and outputs.conf

http://docs.splunk.com/Documentation/Splunk/latest/Data/FilesDirsremote

OR

Configure syslog to send the logs to your indexer. You need to configure your Splunk indexer to also listen on a TCP/UDP port.

http://docs.splunk.com/Documentation/Splunk/latest/Data/SyslogTCP
http://docs.splunk.com/Documentation/Splunk/latest/Data/SyslogUDP

OR

Store the logs on a network share that can be mounted by the indexer. From the splunk indexer perspective, this is pretty much like indexing local files.

/K

View solution in original post

Ayn
Legend

Point the universal forwarder to monitor the logs you're interested in, and set the Splunk instance it should forward to (splunk add forward-server <yoursplunkserver>)

0 Karma

kristian_kolb
Ultra Champion

Either by using a forwarder (which you seem to have), configuring inputs.conf and outputs.conf

http://docs.splunk.com/Documentation/Splunk/latest/Data/FilesDirsremote

OR

Configure syslog to send the logs to your indexer. You need to configure your Splunk indexer to also listen on a TCP/UDP port.

http://docs.splunk.com/Documentation/Splunk/latest/Data/SyslogTCP
http://docs.splunk.com/Documentation/Splunk/latest/Data/SyslogUDP

OR

Store the logs on a network share that can be mounted by the indexer. From the splunk indexer perspective, this is pretty much like indexing local files.

/K

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...