Wondering what the chances are of getting a Universal Forwarder compilation for an ARM device such as Raspberry Pi?
These devices make great little remote machines which would be perfect for monitoring systems in the field.
I am aware I could just have software feed back to Splunk via a port but would love to utilise the Universal Forwarder if possible.
I realize that this is an older thread, but I've had success exporting data to splunk from a raspberry pi without a forwarder. I just send my data to local syslog on the pi and then use socat to forward to a splunk server that has a tcp input.
cat /dev/ttyUSB0 | socat - TCP:192.168.1.23:8765
I don't have the ability to pre-process or queue the events, but the setup has been very reliable. My sensor sends about 12-15 events (event size 80 bytes) per second.
I wouldn't really expect them to be giving me the source codes. However I would love a cross compiled version for Linux running on an ARM chip. Even a beta would be great I dont expect it to be fully supported.
I would think that it would be in Splunk's best interest to get Splunk onto the Raspberry Pi for a few reasons.
I could go on but I think I have made my case.
If someone at Splunk could please provide a Universal Forwarder for this device (even beta) I would be very appreciative. Our company is doing more and more work in SCADA environments and are hoping to leverage the use of many many Raspberry Pi devices combined with a Splunk Universal Forwarder to feed gigs of data into Splunk.
We are currently using the standard release of Debian on the Raspberry Pi
Cross compiling information can be found here
Other OS options can be found here (if you dont like Raspbian)
Being given the code for universal forwarders so they could be end-user compiled would be the best solution. I'm after it so we can compile it for zLinux (s390 architecture), but have had no luck, even through enterprise support channels.
I'd raise a feature request and see how you get on.