Splunk on a read only file system

[daniel333]

All,

We have an application server which has a vendor requirement to operate in read only. We can install taking in/out of read only mode. But it MUST be in read only mode to operate. Is it possible the universal forwarder can operate in this situation?

[jstockamp]

Universal forwarder might work for this, but it would be useful to know what types of inputs you want to use. If the forwarder doesn't work you could always push the data to your splunk server using scp or something similiar (or mount your log directory from the splunk server).