Monitoring logs on another machine without sending the data to splunk server via ftp

[royimad]

Can splunk monitor a log errors.log that exist on another machine without sending the files via ftp/sftp to splunk server and use monitor option in inputs? Is their a simplest way to monitor a distant log file? Can splunk universal forwarder perform this step and do i need to open new ports for that reason ?

[datasearchninja · Accepted solution]

You would need to have the files available via a file based network protocol. Options for this could be:

• nfs
• cifs/samba
• sshfs

To monitor a log file, Splunk needs to be able to track which items have already been indexed. Other options involve making a copy locally so that this can be tracked. These options would be:

• As you suggested, a regular copy of log files scp/ftp etc
• A scripted input that accessed the file over an ssh session, and appended to a local copy that was read by Splunk.