retrofit with splunk logging

kspoton · ‎02-19-2015

Current application just writes the logs to local log file. What is the quick way to integrate Splunk so that logs get written to Splunk as well?

MuS · ‎02-19-2015

Hi kspoton,

Best practice is to install an universal forwarder on the source, set it up to monitor the source directory and forward the events to the Splunk indexer.

See the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Introducingtheuniversalforwarder

cheers, MuS

retrofit with splunk logging

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

retrofit with splunk logging

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...