Currently there are mainframe jobs which is sending data to a splunk instance where the data will be index locally. The data transfer is happening via FTP. Since it's a frame jobs we cannot install splunk forwarders.
We are planning to convert from FTP to SFTP. On mainframe side code chane would be done to make it as sftp.
So for this what changes would required on splunk side ? I believe a key would required ?
Is there better method of transfer or any add-on that we can use ?
Are your servers Linux? You can set-up sftp using below link unless there are any security restrictions with the mainframes server.
Once SFTP is successful and files transferred, you can index data locally