We have a splunk Indexer based on Linux and we have around 40+ servers and network devices in our network.
Want to know how to get all these servers and network devices forward SYSlogs and event logs to the splunk Indexer.
Do I have to install a splunk agent in all the servers? If Yes, what is a Splunk Agent? How do I tell the network devices to send the SYSlog and SNMP logs to Splunk Indexer?
Hello ppram
best thing to do, read the manual http://www.splunk.com/base/Documentation/latest/Data/WhatSplunkcanmonitor and I think all your questions will be answered.
regards, MuS
Hello ppram
best thing to do, read the manual http://www.splunk.com/base/Documentation/latest/Data/WhatSplunkcanmonitor and I think all your questions will be answered.
regards, MuS
Hi ppram
yes, install a light weight forwarder or as from 4.2 on, an universal forwarder on that windows server, configure it as needed and your done.
HI MuS,
Thanks for helping me on this. Now for example if I have a windows server I want to collect all the windows event logs and send it to the Splunk Indexer in another server.
I need to install the splunk in that Windows server and then install the windows APP and forward the log to the Splunk Indexer server?
Please correct me if I am wrong.