Single Splunk Instance / No Forwarders

[lschifano]

Greetings, 

Within my infrastructure, I am hoping to setup a single Splunk instance to ingest uploaded logs for analysis and correlation purposes. The instance would not require forwarders. Is it possible to set Splunk up in this way?

Any help or direction is appreciated!

[s2_splunk]

Absolutely, you can do that. Splunk by default ingests and indexes its own log files from the server it runs on, so you can take a look at how this is setup in etc/system/default/inputs.conf.

Or you can use the UI to upload your file(s) for indexing, but there is a 500MB size limit for that approach.

Probably the easiest approach is to create a directory on your server where you place the log files for ingest. The documentation here should get you started.

There is also a way to configure Splunk to 'destructively' read and ingest a file in batch (sinkhole) and you can use the CLI for a oneshot data upload.

None of this requires a forwarder. 

Good luck!

[lschifano]

Fantastic. Thank you for the response!

[s2_splunk · Accepted solution]

You are welcome. If this answered your question, please mark the question as 'solved' for posterity.

THANKS!