Getting Data In

Can Heavy Forwarder monitor a Folder and forwards to Splunk indexer ?

premrajvs
Explorer

I want to run some commands on my splunk Heavy forwarder servers and output the results to a folder. I want to monitor these folders and push the data to Splunk indexers. Is my only option installing Universal forwarders on the same server or configuring inputs and outputs.conf ?

Labels (2)
0 Karma

premrajvs
Explorer

@gcusello The servers I am referring to are Heavy Forwarder Servers. They are not application servers. I want to run few commands on these Heavy Forwarder servers and output the results to  files and this data I want to push to Splunk and track it. 

0 Karma

gcusello
Esteemed Legend

Hi @premrajvs,

as I said, you can use them to read some files or run some scripts and forwardr data to Splunk.

My question is: why are you using Heavy Forwarders instead Universal Forwarders?

whar are the feature requested to these servers so you decided to use HFs instead UFs?

HFs require more hardware resources (at least 12 CPU and 12 GB RAM), instead UFs requires very few resources.

The only reason to have HFs is that you need them to run some special apps e.g. to pull data from Cloud Providers or from Active Directory, if you have only to read files or execute scripts, you can use an UF.

Ciao.

Giuseppe

0 Karma

gcusello
Esteemed Legend

Hi @premrajvs,

absolutely not: if you have an Heavy Forwarder (or another Full Splunk instance), you can use it to input and forward data to Indexers.

The real question is: do you really need an Heavy Forwarder or can you also use a Universal Forwarder?

Because a Universal Forwarder requires less resources than an HF.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...