Getting Data In

Can I configure my deployment server to send deployment related logs to another splunk for searching?

juniormint
Communicator

I have a dedicated machine for my splunk forwarder configuration deployment server. I would like to send the deployment related logs to another Splunk instance which serves as my indexer/search node.

Any idea how to do this?

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

If you set up your deployment server as a forwarder, by adding an outputs.conf file, you can send its Splunk logs to your indexer. Splunk automatically monitors its internal logs, so your deployment-related logs should be sent automatically. The following example assumes that the indexer is named yourhost.yourcompany.com and that it is listening for input on port 9997.

outputs.conf

[tcpout:group1]
server=yourhost.yourcompany.com:9997

If this doesn't work like you expect, make sure that your deployment server has an inputs.conf that contains something like this:

[monitor://$SPLUNK_HOME/var/log/splunk]
_TCP_ROUTING = *
index = _internal

Here is a good item in the documentation: What Splunk logs about itself

View solution in original post

lguinn2
Legend

If you set up your deployment server as a forwarder, by adding an outputs.conf file, you can send its Splunk logs to your indexer. Splunk automatically monitors its internal logs, so your deployment-related logs should be sent automatically. The following example assumes that the indexer is named yourhost.yourcompany.com and that it is listening for input on port 9997.

outputs.conf

[tcpout:group1]
server=yourhost.yourcompany.com:9997

If this doesn't work like you expect, make sure that your deployment server has an inputs.conf that contains something like this:

[monitor://$SPLUNK_HOME/var/log/splunk]
_TCP_ROUTING = *
index = _internal

Here is a good item in the documentation: What Splunk logs about itself

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...