Can Heavy Forwarder monitor a Folder and forwards to Splunk indexer ?

[premrajvs]

I want to run some commands on my splunk Heavy forwarder servers and output the results to a folder. I want to monitor these folders and push the data to Splunk indexers. Is my only option installing Universal forwarders on the same server or configuring inputs and outputs.conf ?

[premrajvs]

@gcusello The servers I am referring to are Heavy Forwarder Servers. They are not application servers. I want to run few commands on these Heavy Forwarder servers and output the results to  files and this data I want to push to Splunk and track it. 

[gcusello]

Hi @premrajvs ,

you can input these files on an HF in the same way of on UF and also by GUI (it's easiest).

Then youcan forward them to the indexers.

Why do you want to install an UF on the same server?

Ciao.

Giuseppe

[gcusello]

Hi @premrajvs,

as I said, you can use them to read some files or run some scripts and forwardr data to Splunk.

My question is: why are you using Heavy Forwarders instead Universal Forwarders?

whar are the feature requested to these servers so you decided to use HFs instead UFs?

HFs require more hardware resources (at least 12 CPU and 12 GB RAM), instead UFs requires very few resources.

The only reason to have HFs is that you need them to run some special apps e.g. to pull data from Cloud Providers or from Active Directory, if you have only to read files or execute scripts, you can use an UF.

Ciao.

Giuseppe

[gcusello]

Hi @premrajvs,

absolutely not: if you have an Heavy Forwarder (or another Full Splunk instance), you can use it to input and forward data to Indexers.

The real question is: do you really need an Heavy Forwarder or can you also use a Universal Forwarder?

Because a Universal Forwarder requires less resources than an HF.

Ciao.

Giuseppe

[sturmovik]

There are situations where an HF needs to forward log and security data located on itself and running an HF and SUF on the same host runs into problems.