Getting Data In

Installing Splunk as Indexer

traillz
New Member

I am interested in using Splunk! as an indexer, but would like to query other servers/controllers in the network for specific information. Is this possible with 4.2.1 Forwarder?

We are looking to take our Splunk installations down from every server (250+) to one server that queries other servers remotely.

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

If I understand the question, the answer is yes.

A possible implementation would be:

  1. Install a single Splunk indexer on a Linux or Windows server.

  2. Install the Splunk Universal Forwarder on each [production] server that you want to monitor. Configure each forwarder to send the appropriate data to the Splunk indexer.

You could call this the "push" method. As events happen on the production servers, the information is forwarded and indexed. The events will be searchable on the indexer almost immediately after they occur (depending on network latency etc etc)

If you want a single indexer to "pull" data from the production servers, without installing the Splunk forwarders on the production servers, the answer is maybe - but you probably don't want to do it that way. Splunk can do remote WMI for Windows servers, but it is actually faster to use the Universal Forwarder in most cases. And there are other ways to set up your environment, too, using network inputs and/or scripted inputs.

I would not generally recommend an environment where a single server polled all the production servers, with no agent software on the production servers, whether for Splunk or anything else. I think you could have some issues with performance, latency, resilience, restart/recovery, etc. -- problems that the Universal Forwarder has already solved for you,

View solution in original post

lguinn2
Legend

If I understand the question, the answer is yes.

A possible implementation would be:

  1. Install a single Splunk indexer on a Linux or Windows server.

  2. Install the Splunk Universal Forwarder on each [production] server that you want to monitor. Configure each forwarder to send the appropriate data to the Splunk indexer.

You could call this the "push" method. As events happen on the production servers, the information is forwarded and indexed. The events will be searchable on the indexer almost immediately after they occur (depending on network latency etc etc)

If you want a single indexer to "pull" data from the production servers, without installing the Splunk forwarders on the production servers, the answer is maybe - but you probably don't want to do it that way. Splunk can do remote WMI for Windows servers, but it is actually faster to use the Universal Forwarder in most cases. And there are other ways to set up your environment, too, using network inputs and/or scripted inputs.

I would not generally recommend an environment where a single server polled all the production servers, with no agent software on the production servers, whether for Splunk or anything else. I think you could have some issues with performance, latency, resilience, restart/recovery, etc. -- problems that the Universal Forwarder has already solved for you,

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...