Getting Data In

How to feed Splunk with remote custom input?

mxmauro
Engager

Hi,

I want to create an app to feed a Splunk server with my custom data. I saw in C# sdk I can build a ModularInput application and install it on the main server.

But I don't understand how to do the same on remote machines. I installed the universal forwarder in another computer to begin my tests but don't know:

  1. How to link my app with the universal forwarder or create an app to directly feed a remote server.
  2. How to start my app installed on a remote computer from the main server.

Thanks,
Mauro.

0 Karma

strive
Influencer

Assuming you can reach your remote machine from the main server, here you go

  1. You can create an app that gets deployed on universal forwarder and takes care of log forwarding. You can use deployment server to deploy app on your other machine.
  2. In the forwarder app that you have created, you need to configure inputs.conf and outputs.conf to monitor and to forward logs respectively.
  3. To deploy apps on other systems you need to configure serverclass.conf

The following are the links that will help you with all the configurations that you need to do

Deploy Apps to clients - http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Updateconfigurations
Deployment Server and Forwarder Management - http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Aboutdeploymentserver

Getting data in using forwarders - http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/Usingforwardingagents
Wiki link with many topics - http://wiki.splunk.com/Community:Getting_data_into_Splunk

If you have already tried some of these then post your configurations. Splunkers will help you.

mxmauro
Engager

Hi Strive, do you have any sdk documentation about how to link a modularinput app to the universal forwared, if it is really needed?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...