Splunk forwarder accept files from remote server

[pasokkum]

Hi Team,

We are installing forwarder on one server and would require to connect to a remote server for getting the log files. Please let me know if there is any configuration entry that needs to be made in the inputs.conf for connecting to the remote host. Also if there is any sample configuration file that I can refer for this scenario.

Thanks,
Soumya

[muebel]

Hi Soumya, The best practice would be to install the forwarder on the remote server as well. If that isn't possible, you could possibly leverage syslog (or some equivalent if windows) to forward the events from the one server to the other.

For syslog, this blog post has some great config examples : http://www.georgestarcher.com/splunk-success-with-syslog/

Please let me know if this helps!