How to collect FTP and SFTP activity on servers via Splunk?

[eboyd]

We would like to gather information on inbound and outbound ftp and secure ftp connections made to our servers from within our intranet. The message should be logged on the server logs. I need to know how I can query Splunk to pickup this information.

Note: This is not related to sending the log files into Splunk using FTP. All searches I have done thus far are just related to the topic of moving log files to Splunk using ftp.

[myriadic]

If the logs are on the ftp server, can you just install the universal forwarder to send them to splunk?

[woodcock]

Your most flexible option is to use stream:

https://splunkbase.splunk.com/app/1809/