Getting Data In

Indexing logs to remote server

eippops
New Member

I have installed 1 forwarder on my linux machine-1 and another on windows apache machine-2. The splunk has been installed on another windows machine-3. i was able to enable the receiving and am able to view forwader in splunk.
Now i need to monitor my apache logs from machine-1 and application logs from machine-2 from the remote machine-3 where splunk is installed. I have read the documentations, but it didnt helped me much.
What entry need to be made in outputs.conf on forwader and inputs.conf on splunk for this requirement.

0 Karma

aholzer
Motivator

This is a general guideline of where the different conf files should live. If you need more details I suggest you re-read the documentation with this guideline in mind. Good luck.

inputs.conf needs to be defined on both the forwarders and the indexers.

  • On the forwarders it needs to define what you are monitoring and what index to write to
  • On the indexer it needs to define the port and such that it needs to listen at

outputs.conf needs to be defined on the forwarders

  • It needs to define what indexer it will write to

props.conf needs to be defined on the indexer

  • It needs to define how to parse the data by sourcetype that it receives

indexes.conf needs to be defined on the indexer

  • It needs to define the basic information for where the data should be stored
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...