Getting Data In

Is there a risk of losing log data in HTTP event Collector?

c71996
Path Finder

I want to use Splunk for Enterprise level centralized logging.

It collects data from all applications and systems.

Need inputs and approach.

HTTP event Collector is better to collect application logs?

On more load of logs ....does it have the risk of losing log data in HTTP event Collector?

0 Karma

nickhills
Ultra Champion

These are very basic quiestions which would very need detailed responses.

I would start with this guide: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Getstartedwithgettingdatain
and: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Usingforwardingagents

HTTP event Collector is a high throughput tool, but given the format and context of your question I suggest you start with Universal Forwarders to collect application logs.

If my comment helps, please give it a thumbs up!
0 Karma

c71996
Path Finder

Does forwarder creates events based on application log log files incremental way and send events tk splunk ?

0 Karma

nickhills
Ultra Champion

Yes, a forwarder will read application log files (text based, windows event logs, and thousands of others) incrementally, and will create an event in Splunk for each event in the log file.

Each application can be configured to send logs to different sourcetypes allowing you to search, filter or collorate across hosts, applications and event data

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...