Getting Data In

Index Local Machine

eantonio
Path Finder

I'm very new to Splunk. I just installed it in my environment and in the process of testing it. I'm wondering why a lot of the options/settings are giving me the option to Index the local Splunk Server. Isn't the point of Splunk is to Index/Manage Remote Servers? Why is there a need to index/log the local Splunk Server? I installed my Splunk Instance in a brand new virtual server so I don't see the point of pulling logs out of this server.
Thank you for the explanation in advance.

0 Karma
1 Solution

kdenton
Path Finder

You are correct, the entire idea with that is to have your data sent to Splunk for indexing.

Usually you get data to spunk either using the Universal Forwarder, syslog (514) or monitoring remote directories.

I have had one case where I did have a script copy data to another partition on my spunk server to be indexed, but it was a very small amount of data that was being moved and indexed due to some restrictions on our network.

Also, from experience be careful with running spunk on Virtual machines, your index and search performance will vary depending on the amount of data being ingested per minute and as your data set starts to grow.

View solution in original post

0 Karma

JSapienza
Contributor

This really depends on your intent with splunk. Typically Splunk is used to index data from multiple machines and not just the machine that acting as your splunk search-head and indexer. Data is index in splunk to make it searchable. If you only have your local machine forwarding data then that's all you will see.

This might help clear things up : Distributed Splunk overview

0 Karma

kdenton
Path Finder

You are correct, the entire idea with that is to have your data sent to Splunk for indexing.

Usually you get data to spunk either using the Universal Forwarder, syslog (514) or monitoring remote directories.

I have had one case where I did have a script copy data to another partition on my spunk server to be indexed, but it was a very small amount of data that was being moved and indexed due to some restrictions on our network.

Also, from experience be careful with running spunk on Virtual machines, your index and search performance will vary depending on the amount of data being ingested per minute and as your data set starts to grow.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...