There are a few ways to onboard data into Splunk.
- Install a universal forwarder on the server to send log files to Splunk
- Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
- Use the server's API to extract data for indexing
- Use Splunk DB Connect to pull data from the server's SQL database.
- Have the application send data directly to Splunk using HTTP Event Collector (HEC).
---
If this reply helps you, Karma would be appreciated.