Getting Data In

Collect remote files using SFTP

npr72
New Member

Hi all,

Is there any native way of configuring splunk or forwarders to periodically collect files using SFTP ?

It seems that it does not exist but I'm very surprised.

Am I wrong ?

Thanks in advance

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You could write a scripted input that does the SFTP for you.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jkat54
SplunkTrust
SplunkTrust

There’s an app that makes splunk into an ftp server for receiving files... not sure if that helps.

https://splunkbase.splunk.com/app/3318/

But yeah I’d make a scripted input as Rich suggested. The scripted input would download the files to a staging area and then I’d use a monitor stanza input to monitor the staging area and index files that are arriving. The stdout of the scripted input would be logged to help you find errors with the script too

0 Karma

FrankVl
Ultra Champion

Not that I'm aware of. So you would either need to create a modular input for that on the splunk side, or script on the source side to push the logs to the splunk box.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...