Security

Is it possible for Splunk to read from a firewall using just the command line interface?

mahmudomer
Engager

Using Ubuntu, Is it possible for Splunk to read from a firewall that's setup and output results in real time or in a log without using any splunk apps and just using command line?
If it is possible any direction on how I could go about it?

Thanks.

0 Karma

vasanthmss
Motivator

Hi Mahmudomer,

You can monitor any local / Remote directory from command line by running command with required parameter.
Local,

 ./splunk add monitor <log path>

In-Case the files are in remote then you can use TCP/UDP. Read Splunk documentation Link

Mount filesystem / soft link may help you .

V
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...