Getting Data In

Index Local Machine

eantonio
Path Finder

I'm very new to Splunk. I just installed it in my environment and in the process of testing it. I'm wondering why a lot of the options/settings are giving me the option to Index the local Splunk Server. Isn't the point of Splunk is to Index/Manage Remote Servers? Why is there a need to index/log the local Splunk Server? I installed my Splunk Instance in a brand new virtual server so I don't see the point of pulling logs out of this server.
Thank you for the explanation in advance.

0 Karma
1 Solution

kdenton
Path Finder

You are correct, the entire idea with that is to have your data sent to Splunk for indexing.

Usually you get data to spunk either using the Universal Forwarder, syslog (514) or monitoring remote directories.

I have had one case where I did have a script copy data to another partition on my spunk server to be indexed, but it was a very small amount of data that was being moved and indexed due to some restrictions on our network.

Also, from experience be careful with running spunk on Virtual machines, your index and search performance will vary depending on the amount of data being ingested per minute and as your data set starts to grow.

View solution in original post

0 Karma

JSapienza
Contributor

This really depends on your intent with splunk. Typically Splunk is used to index data from multiple machines and not just the machine that acting as your splunk search-head and indexer. Data is index in splunk to make it searchable. If you only have your local machine forwarding data then that's all you will see.

This might help clear things up : Distributed Splunk overview

0 Karma

kdenton
Path Finder

You are correct, the entire idea with that is to have your data sent to Splunk for indexing.

Usually you get data to spunk either using the Universal Forwarder, syslog (514) or monitoring remote directories.

I have had one case where I did have a script copy data to another partition on my spunk server to be indexed, but it was a very small amount of data that was being moved and indexed due to some restrictions on our network.

Also, from experience be careful with running spunk on Virtual machines, your index and search performance will vary depending on the amount of data being ingested per minute and as your data set starts to grow.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...