Getting Data In

How does Splunk get logs from Linux or Windows servers?

cyberportnoc
Explorer

i am a beginner

how do splunk get log from linux server or window server?

do (Active) splunk actively get log from linux server or window server or (Passive) linux server or window server send log to splunk actively ?

if splunk actively get log from linux server or window server , where can i configure this server list in splunk?
if linux server or window server send log to splunk that get log passively, what is the command and format do i need to send this log

can i send window server log with python script using udp to send to splunk like send to syslog of linux ?
what is the ip address and port i need to send

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cyberportnoc,
as suggested by esix, see http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor.

The easiest way is to install a Universal forwarder on you server to monitor and deploy on each one two Technical Add-Ons (TAs):

In these TAs you can find all the scripts and monitoring stanzas to monitor all your servers.
The only activity you have to do is choose what do you need (wineventogs, processes, installed softwares, perfmon, etc...) and enable the related stanzas of inputs.conf changing disabled=1 in disabled=0 in the requested stanzas.

I have only two recommendations:
- analyze your requests before start your activity because you could have too logs and exceed your license;
- if you have to configure a production environment with many servers use a Deployment Server to deploy TAs in your monitored servers ( http://docs.splunk.com/Documentation/Splunk/7.0.0/Updating/Aboutdeploymentserver ).

Bye.
Giuseppe

esix_splunk
Splunk Employee
Splunk Employee

I think you should read docs on how to Get Data into Splunk, here is a great starting point : http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/WhatSplunkcanmonitor .

In a nutshell, there is an agent (Universal Forwarder) that you deploy. On this agent, you tell it what to collect and where to send it.

cyberportnoc
Explorer

i find previous peer's guideline, he use add data -> upload, it upload a zip file and then choose server
but what is this zip file, what do it zip?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

That would be a zip file from a server, and it contains log files. If you dont know what ZIP, or archive files are, you should spend sometime on your favorite search engine to understand archive files.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...