Getting Data In
Highlighted

Monitoring logs on another machine without sending the data to splunk server via ftp

Builder

Can splunk monitor a log errors.log that exist on another machine without sending the files via ftp/sftp to splunk server and use monitor option in inputs? Is their a simplest way to monitor a distant log file? Can splunk universal forwarder perform this step and do i need to open new ports for that reason ?

0 Karma
Highlighted

Re: Monitoring logs on another machine without sending the data to splunk server via ftp

Communicator

You would need to have the files available via a file based network protocol. Options for this could be:

  • nfs
  • cifs/samba
  • sshfs

To monitor a log file, Splunk needs to be able to track which items have already been indexed. Other options involve making a copy locally so that this can be tracked. These options would be:

  • As you suggested, a regular copy of log files scp/ftp etc
  • A scripted input that accessed the file over an ssh session, and appended to a local copy that was read by Splunk.

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.