Getting Data In

Can Heavy Forwarder monitor a Folder and forwards to Splunk indexer ?

premrajvs
Explorer

I want to run some commands on my splunk Heavy forwarder servers and output the results to a folder. I want to monitor these folders and push the data to Splunk indexers. Is my only option installing Universal forwarders on the same server or configuring inputs and outputs.conf ?

Labels (2)
0 Karma

premrajvs
Explorer

@gcusello The servers I am referring to are Heavy Forwarder Servers. They are not application servers. I want to run few commands on these Heavy Forwarder servers and output the results to  files and this data I want to push to Splunk and track it. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @premrajvs ,

you can input these files on an HF in the same way of on UF and also by GUI (it's easiest).

Then youcan forward them to the indexers.

Why do you want to install an UF on the same server?

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @premrajvs,

as I said, you can use them to read some files or run some scripts and forwardr data to Splunk.

My question is: why are you using Heavy Forwarders instead Universal Forwarders?

whar are the feature requested to these servers so you decided to use HFs instead UFs?

HFs require more hardware resources (at least 12 CPU and 12 GB RAM), instead UFs requires very few resources.

The only reason to have HFs is that you need them to run some special apps e.g. to pull data from Cloud Providers or from Active Directory, if you have only to read files or execute scripts, you can use an UF.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @premrajvs,

absolutely not: if you have an Heavy Forwarder (or another Full Splunk instance), you can use it to input and forward data to Indexers.

The real question is: do you really need an Heavy Forwarder or can you also use a Universal Forwarder?

Because a Universal Forwarder requires less resources than an HF.

Ciao.

Giuseppe

0 Karma

sturmovik
Observer

There are situations where an HF needs to forward log and security data located on itself and running an HF and SUF on the same host runs into problems. 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...