How to add hosts?

[Alan_Bradley]

I do not see in any of the manuals or Help how to add host servers. You label the targets as Host on the main page but a search does not return anything applicable.

[matt · Accepted solution]

Splunk is not able to blindly connect to a remote machine and collect system information. We require a user agent of some sort that will grant the necessary access. There are a number ways of that you can get data from remote systems into your Splunk instance.

1. You can install a forwarding agent on each of the machines that you wish to collect data from that will send events to the central indexer. More information on data cloning and routing can be found here: http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/AboutforwardingandreceivingdataReceiving
2. You can configure syslog/syslog-ng to forward event data to a central Splunk index. You will then configure Splunk to listen on the specified UDP (syslog) or TCP (syslog-ng) port. More information on configuring Splunk to listen on a network port can be found here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitornetworkports
3. You can write a small script that collects the various files from your remote systems and feeds them into your index using our scripted input method. More information on scripted inputs can be found here: http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ScriptedInputsIntro