Collect remote files using SFTP

[npr72]

Hi all,

Is there any native way of configuring splunk or forwarders to periodically collect files using SFTP ?

It seems that it does not exist but I'm very surprised.

Am I wrong ?

Thanks in advance

[richgalloway]

You could write a scripted input that does the SFTP for you.

[jkat54]

There’s an app that makes splunk into an ftp server for receiving files... not sure if that helps.

https://splunkbase.splunk.com/app/3318/

But yeah I’d make a scripted input as Rich suggested. The scripted input would download the files to a staging area and then I’d use a monitor stanza input to monitor the staging area and index files that are arriving. The stdout of the scripted input would be logged to help you find errors with the script too

[FrankVl]

Not that I'm aware of. So you would either need to create a modular input for that on the splunk side, or script on the source side to push the logs to the splunk box.