Getting Data In

Splunk Forwarder and Receiver Problem

mehal
New Member

Hi All,

I am trying to setup a system where I need to get data from my storage server - Y onto splunk instance running on different server, we name it X. The only way ( probably ) i can access Y is to mount it on server X. Once mounted i can access data on server Y.

Now as far as I understood the process, I need to install splunk forwarder on server Y so that I can receive data on my splunk receiver which is on server X. But i am really stuck with how i can install/deploy splunk forwarder on server Y with access only from server X.

Please help me clarify points from above which possibly you did not understand.

Mehal

Tags (2)
0 Karma
1 Solution

Ayn
Legend

If you can mount the storage from Y onto X, you don't need to install a forwarder on Y. Just setup the mount properly so there's a file system path on X that can be used for accessing Y's storage, then setup your forwarder on X to monitor that path.

View solution in original post

0 Karma

Ayn
Legend

If you can mount the storage from Y onto X, you don't need to install a forwarder on Y. Just setup the mount properly so there's a file system path on X that can be used for accessing Y's storage, then setup your forwarder on X to monitor that path.

0 Karma

mehal
New Member

Yes, I tried following that but doesn't helping me much.
I did below to inputs.conf and outputs.conf files :

In SplunkForwarder:
I edited outputs.conf with following

[monitor://mnt/cloudstorage/unzipped_data]
_TCP_ROUTING = *
index = _internal
sourcetype=airtime_csv

edited inputs.conf with following
[tcpout:splunkindexer]
server = ipaddress:9997

In Splunk:
I edited outputs.conf with following

Edited inputs.conf with below
[splunktcp:9997]

and nothing for outputs.conf

But not working out.Also do we change above files in /etc/system/local directory or /etc/system/default directory ?

0 Karma

Ayn
Legend

It's covered pretty well in the docs, so my suggestion is for you to have a look there, and if you encounter any specific issues you're free to ask questions here on splunkbase.

0 Karma

mehal
New Member

Hi Ayn,
I mounted storage with following command.
mount -t cifs //hostname/dirc /mnt/dirname -o user=user,pass=pass
Also, I tried installing forwarder on X and did something with outputs.conf and inputs.conf but that doesn't seem to help either. Considering i mounted drive correctly can you help me out with configuring output.conf and input.conf files of forwarder and receiver. ?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...