Hiow to forward events from servers and network devices

[ppram]

We have a splunk Indexer based on Linux and we have around 40+ servers and network devices in our network.

Want to know how to get all these servers and network devices forward SYSlogs and event logs to the splunk Indexer.

Do I have to install a splunk agent in all the servers? If Yes, what is a Splunk Agent? How do I tell the network devices to send the SYSlog and SNMP logs to Splunk Indexer?

[MuS · Accepted solution]

Hello ppram

best thing to do, read the manual http://www.splunk.com/base/Documentation/latest/Data/WhatSplunkcanmonitor and I think all your questions will be answered.

regards, MuS

[MuS]

Hi ppram

yes, install a light weight forwarder or as from 4.2 on, an universal forwarder on that windows server, configure it as needed and your done.

[ppram]

HI MuS,

Thanks for helping me on this. Now for example if I have a windows server I want to collect all the windows event logs and send it to the Splunk Indexer in another server.

I need to install the splunk in that Windows server and then install the windows APP and forward the log to the Splunk Indexer server?

Please correct me if I am wrong.