Getting Data In

Monitoring logs on another machine without sending the data to splunk server via ftp

royimad
Builder

Can splunk monitor a log errors.log that exist on another machine without sending the files via ftp/sftp to splunk server and use monitor option in inputs? Is their a simplest way to monitor a distant log file? Can splunk universal forwarder perform this step and do i need to open new ports for that reason ?

0 Karma
1 Solution

datasearchninja
Communicator

You would need to have the files available via a file based network protocol. Options for this could be:

  • nfs
  • cifs/samba
  • sshfs

To monitor a log file, Splunk needs to be able to track which items have already been indexed. Other options involve making a copy locally so that this can be tracked. These options would be:

  • As you suggested, a regular copy of log files scp/ftp etc
  • A scripted input that accessed the file over an ssh session, and appended to a local copy that was read by Splunk.

View solution in original post

datasearchninja
Communicator

You would need to have the files available via a file based network protocol. Options for this could be:

  • nfs
  • cifs/samba
  • sshfs

To monitor a log file, Splunk needs to be able to track which items have already been indexed. Other options involve making a copy locally so that this can be tracked. These options would be:

  • As you suggested, a regular copy of log files scp/ftp etc
  • A scripted input that accessed the file over an ssh session, and appended to a local copy that was read by Splunk.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...