Getting Data In

What is the best way to get data from a Linux forwarder to a Windows indexer?

Engager

Hi all,

We have a Windows Splunk Indexer, and a single linux server which we have installed the UF on, what is the best way to get the data from the forwarder as we can't use WMI?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

The Forwarder/Indexer relationship can be considered platform agnostic (within the sphere of supported platforms) because they exchange their data handshake (and the data, if you wish) over TCP.

Configure the indexer to listen on a port (TCP 9997 by default)
Configure the forwarder to output data to you indexer:listeningPort
(See Configure forwarder with outputs.conf)
Be sure that you have edited the respective firewalls to allow communication on those ports.

configure inputs.conf on the forwarder to monitor data or ports etc... using standard "Getting Data In" practices.

The forwarder will send a heartbeat to the indexer over an interval. As long as the indexer answers back... the forwarder will send data in 64k chunks to your indexer.

Check THIS out for step by step.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

Splunk Employee
Splunk Employee

The Forwarder/Indexer relationship can be considered platform agnostic (within the sphere of supported platforms) because they exchange their data handshake (and the data, if you wish) over TCP.

Configure the indexer to listen on a port (TCP 9997 by default)
Configure the forwarder to output data to you indexer:listeningPort
(See Configure forwarder with outputs.conf)
Be sure that you have edited the respective firewalls to allow communication on those ports.

configure inputs.conf on the forwarder to monitor data or ports etc... using standard "Getting Data In" practices.

The forwarder will send a heartbeat to the indexer over an interval. As long as the indexer answers back... the forwarder will send data in 64k chunks to your indexer.

Check THIS out for step by step.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!