Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to add hosts to splunk server
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The short answer is
On the main splunk installation (call it Indexer/Search Interface/Splunk Web); go into Manager, go into "Forwarding and Receiving", click "Enable Receiving", fill in a port number, e.g. 9997.
On the Forwarder, it's probably easiest if you simply
su splunk/opt/splunk/bin/splunk add forward-server <IP:port>
That sets up the connection between the two hosts.
But I suggest you read up on the docs, there is a 'tutorial' section that will cover the basics, and a 'distributed deployment' section that will cover forwarding. There is also a 'getting data in' section with detailed 'recipies' for various scenarios.
http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/WelcometotheSplunkTutorial
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor
Hope this helps,
K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The short answer is
On the main splunk installation (call it Indexer/Search Interface/Splunk Web); go into Manager, go into "Forwarding and Receiving", click "Enable Receiving", fill in a port number, e.g. 9997.
On the Forwarder, it's probably easiest if you simply
su splunk/opt/splunk/bin/splunk add forward-server <IP:port>
That sets up the connection between the two hosts.
But I suggest you read up on the docs, there is a 'tutorial' section that will cover the basics, and a 'distributed deployment' section that will cover forwarding. There is also a 'getting data in' section with detailed 'recipies' for various scenarios.
http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/WelcometotheSplunkTutorial
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor
Hope this helps,
K
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
