Getting Data In

Installing Splunk as Indexer

traillz
New Member

I am interested in using Splunk! as an indexer, but would like to query other servers/controllers in the network for specific information. Is this possible with 4.2.1 Forwarder?

We are looking to take our Splunk installations down from every server (250+) to one server that queries other servers remotely.

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

If I understand the question, the answer is yes.

A possible implementation would be:

  1. Install a single Splunk indexer on a Linux or Windows server.

  2. Install the Splunk Universal Forwarder on each [production] server that you want to monitor. Configure each forwarder to send the appropriate data to the Splunk indexer.

You could call this the "push" method. As events happen on the production servers, the information is forwarded and indexed. The events will be searchable on the indexer almost immediately after they occur (depending on network latency etc etc)

If you want a single indexer to "pull" data from the production servers, without installing the Splunk forwarders on the production servers, the answer is maybe - but you probably don't want to do it that way. Splunk can do remote WMI for Windows servers, but it is actually faster to use the Universal Forwarder in most cases. And there are other ways to set up your environment, too, using network inputs and/or scripted inputs.

I would not generally recommend an environment where a single server polled all the production servers, with no agent software on the production servers, whether for Splunk or anything else. I think you could have some issues with performance, latency, resilience, restart/recovery, etc. -- problems that the Universal Forwarder has already solved for you,

View solution in original post

lguinn2
Legend

If I understand the question, the answer is yes.

A possible implementation would be:

  1. Install a single Splunk indexer on a Linux or Windows server.

  2. Install the Splunk Universal Forwarder on each [production] server that you want to monitor. Configure each forwarder to send the appropriate data to the Splunk indexer.

You could call this the "push" method. As events happen on the production servers, the information is forwarded and indexed. The events will be searchable on the indexer almost immediately after they occur (depending on network latency etc etc)

If you want a single indexer to "pull" data from the production servers, without installing the Splunk forwarders on the production servers, the answer is maybe - but you probably don't want to do it that way. Splunk can do remote WMI for Windows servers, but it is actually faster to use the Universal Forwarder in most cases. And there are other ways to set up your environment, too, using network inputs and/or scripted inputs.

I would not generally recommend an environment where a single server polled all the production servers, with no agent software on the production servers, whether for Splunk or anything else. I think you could have some issues with performance, latency, resilience, restart/recovery, etc. -- problems that the Universal Forwarder has already solved for you,

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...