Getting Data In

How to get data from an external source machine

vrmandadi
Builder

What would be a way to get data from an external machine which is not part of our environment .Correct me if I am wrong .I was assuming to install UF on the external machine , create an HTTP token on a HF in our environment and give the token , URL and port details to get the data from the external machine .

Is this the way to get data through external machine through HTTP token.The data in a custom path and the data is in csv format.

Thanks in Advance

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Universal Forwarder (UF) typically is the easiest way to get data into Splunk. The UF does not use HTTP tokens, however, It sends data directly to your indexers on port 9997 (by default). When you configure the UF, tell it to monitor the CSV file and send all output to your indexer(s).

Of course, since the UF is not in your environment you first should ensure a UF will be allowed to connect to your indexers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

Is there way that we can send through the HTTP tokens?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes. Write, acquire, or modify one of your existing programs to send data to the HTTP Event Collector (HEC) using a token for authentication. See https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/Data/Senddata for how to send data to HEC.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

Thanks.One small confirmation.Can we send .csv files from a custom location on the remote server to splunk via HTTP tokens

0 Karma

richgalloway
SplunkTrust
SplunkTrust

HTTP tokens are an authentication mechanism, not a transport mechanism.
If you can represent the CSV file in a form specified in the link above then it should work.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...