Getting Data In

FTP Server Logs

Michael_Schyma1
Contributor

How would i configure Splunk to input all FTP logs from my Splunk server? Anybody have any suggestions on what they do, or Splunk documenation on this topic. (At this point all of the logs will be sent to the Splunk server via univeral forwarder)

Tags (3)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

if the logs are in the same server in the folder
/mylog/ftp/ and look like myftp.log (or myftp.log.1 or myftp.log.2.gz etc...)

Collect a sample and index it using the manager, it will help you figure the best sourcetype configuration (linebreak parsing, timestamp detection...)

Then once done create a monitor input on the folder/logfile using the manager or the configuration file.
[monitor:///mylog/ftp/myftp.*]
sourcetype=mysourcetypefortmyftp

If the log files are not on the same server than your splunk indexer, then you can install the universal forwarder as an agent on the box that has the logs (and make sure to define the sourcetype in props.conf on the indexer).
Or an alternative is to use a network mount for the log folder no the splunk indexer.

View solution in original post

yannK
Splunk Employee
Splunk Employee

if the logs are in the same server in the folder
/mylog/ftp/ and look like myftp.log (or myftp.log.1 or myftp.log.2.gz etc...)

Collect a sample and index it using the manager, it will help you figure the best sourcetype configuration (linebreak parsing, timestamp detection...)

Then once done create a monitor input on the folder/logfile using the manager or the configuration file.
[monitor:///mylog/ftp/myftp.*]
sourcetype=mysourcetypefortmyftp

If the log files are not on the same server than your splunk indexer, then you can install the universal forwarder as an agent on the box that has the logs (and make sure to define the sourcetype in props.conf on the indexer).
Or an alternative is to use a network mount for the log folder no the splunk indexer.

Ayn
Legend

What ftpd are we talking about? Do you have log samples?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

You have a splunk forwarder on the FTP server currently? That is the most straightforward way to monitor any logs on that or any server. Is there an issue or are you just looking for another way?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...