How to get data from an external source machine

[vrmandadi]

What would be a way to get data from an external machine which is not part of our environment .Correct me if I am wrong .I was assuming to install UF on the external machine , create an HTTP token on a HF in our environment and give the token , URL and port details to get the data from the external machine .

Is this the way to get data through external machine through HTTP token.The data in a custom path and the data is in csv format.

Thanks in Advance

[richgalloway]

The Universal Forwarder (UF) typically is the easiest way to get data into Splunk. The UF does not use HTTP tokens, however, It sends data directly to your indexers on port 9997 (by default). When you configure the UF, tell it to monitor the CSV file and send all output to your indexer(s).

Of course, since the UF is not in your environment you first should ensure a UF will be allowed to connect to your indexers.

[vrmandadi]

Is there way that we can send through the HTTP tokens?

[richgalloway]

Yes. Write, acquire, or modify one of your existing programs to send data to the HTTP Event Collector (HEC) using a token for authentication. See https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/Data/Senddata for how to send data to HEC.

[vrmandadi]

Thanks.One small confirmation.Can we send .csv files from a custom location on the remote server to splunk via HTTP tokens

[richgalloway]

HTTP tokens are an authentication mechanism, not a transport mechanism.
If you can represent the CSV file in a form specified in the link above then it should work.