Can we use the usual Splunk Universal Forwarder to collect and send metrics to Splunk Insights for Infrastructure?

[skulk]

When you deploy Splunk Insights for Infrastructure you use the specific script to install a forwarder. Can we use Splunk Universal Forwarder to collect and send metrics to Splunk Insights for Infrastructure and to send other logs to a different Splunk Instance at the same time?

[virgaramada]

The answers are not very clear for me. I believe I have a same case: if I want to combine logs (system logs, and app server logs such as catalina logs, jboss logs, etc) and metrics from both windows and linux servers, And no remote access to the metrics nor logs, thus only possible with forwarder. What is the best platform? Is it Splunk Enterprise or Splunk Insight for Infrastucture? And how to do it? please share some tutorials. Thanks

[vshcherbakov_sp]

@virgaramada, you may want to start with Splunk Insights for Infrastructure first, as it is designed to simplify the data log and metric data onboarding, correlation, alerting, etc. To find out more, please check out SII's Getting started page.

[vshcherbakov_sp]

@virgaramada, you may want to start with Splunk Insights for Infrastructure first, as it is designed to simplify the data log and metric data onboarding, correlation, alerting, etc. To find out more, please check out SII's Getting started page.

[ntankersley_spl]

this depends on the use case. For Windows data, all metrics are collected via perfmon inputs on the UF. These are native inputs to the UF and the payloads are transformed to metrics in the indexing pipeline.

For Linux hosts, the UF is used to send logs to splunk using the S2S protocol. Collectd is the metrics collection agent and send direct to Splunk HEC (HTTP Event Collector) which is the Splunk recommended input for metrics.

[omprakash9998]

How can we use the existing windows universal forwarders and the data coming in to splunk Enterprise and use them in splunk app for infrastructure

[pwu_splunk]

No, the Splunk Universal Forwarder is not collecting and sending metrics to Splunk Insights for Infrastructure (SII). The component that does so is Collectd which is also installed by the installation script. The Splunk Universal Forwarder is the component sending logs to SII.