How to index data from a local process

[MatMeredith]

I'm using a Splunk forwarder to forward data from an application running on the same Linux box as my forwarder.

Obviously I could have my process write out all the data to disk, and have Splunk monitor these files for new data. However, the disk is already heavily loaded on this box, and this doesn't seem terribly efficient.

Is there a better solution?

[martin_mueller]

Going through files often is the best solution, but there are alternatives. You could have the application write syslog entries ovto the network and have Splunk receive them, or you could let the application enter data into Splunk directly through its REST API. What's best for your case depends on your case.