What documentation can I use as reference to set up forwarding data from my Tomcat servers to my local instance?

[appzen]

I am new to Splunk and I am trying to find the right documentation to get started. My goal is to get the logs from catalina.out from two separate servers. I have downloaded Splunk locally and I think that this must be achieved by sending data via the forward option. I am not sure on how to connect to my servers and do I need to download some splunk software to the servers as a well as locally? Thanks.

[chanfoli]

Yes, you would want to at a minimum have a full splunk instance set up on a server meeting the system requirements. This would be your indexer and search-head which you would configure to receive data on the default TCP port or a port of your choosing. Then you would install the universal forwarder on your tomcat servers, configure them to output data to your indexer's hostname/IP, and port as well as configure to monitor the files you want to start indexing.

This is pretty straight-forward stuff but it is not trivial to explain and documentation is already written to cover the process. See the following links as well as the rest of the Getting Data In and introductory section:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configureyourinputs

http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Introducingtheuniversalforwarder