Getting Data In

How to feed Splunk with remote custom input?

mxmauro
Engager

Hi,

I want to create an app to feed a Splunk server with my custom data. I saw in C# sdk I can build a ModularInput application and install it on the main server.

But I don't understand how to do the same on remote machines. I installed the universal forwarder in another computer to begin my tests but don't know:

  1. How to link my app with the universal forwarder or create an app to directly feed a remote server.
  2. How to start my app installed on a remote computer from the main server.

Thanks,
Mauro.

0 Karma

strive
Influencer

Assuming you can reach your remote machine from the main server, here you go

  1. You can create an app that gets deployed on universal forwarder and takes care of log forwarding. You can use deployment server to deploy app on your other machine.
  2. In the forwarder app that you have created, you need to configure inputs.conf and outputs.conf to monitor and to forward logs respectively.
  3. To deploy apps on other systems you need to configure serverclass.conf

The following are the links that will help you with all the configurations that you need to do

Deploy Apps to clients - http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Updateconfigurations
Deployment Server and Forwarder Management - http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Aboutdeploymentserver

Getting data in using forwarders - http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/Usingforwardingagents
Wiki link with many topics - http://wiki.splunk.com/Community:Getting_data_into_Splunk

If you have already tried some of these then post your configurations. Splunkers will help you.

mxmauro
Engager

Hi Strive, do you have any sdk documentation about how to link a modularinput app to the universal forwared, if it is really needed?

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...