How to deploy a Splunk environment to monitor switches, routers, and database servers within our local area network?

[Nesrinepfe]

Hi,

I would like to know the environment to install in case I use Splunk Enterprise (Trial version). I just want to oversee the local area network containing switches, routers, servers DB to supervise it. So how I can to link such equipment to Splunk and to send their logs to Splunk for indexing?

Thanks!
Nesrine

[muebel · Accepted solution]

Hi Nesrinepfe, usually for network equipment you'd setup a syslog server, and configure the devices to forward to it, writing locally to a directory for each device, and then configure a universal forwarder to input the resulting file. See here for more info : http://www.georgestarcher.com/splunk-success-with-syslog/

For a database, splunk makes the DB connect app available here : https://splunkbase.splunk.com/app/2686/. You can use this to pull DB queries into Splunk. If you otherwise want logs from the OS of the Database Server, you'd want to install the universal forwarder there and configure it appropriately.

Please let me know if this helps!

[Nesrinepfe]

Thank you very much for your answer muebel.It helps me !