Splunk Enterprise

How to configure sending logs from suse linux virtual machine to Splunk Server?

ravind
Observer

Hi Team,  I just need to send logs from linux client machine (Suse linux) to the Splunk Server hosted in a remote datacenter.  I would like to ask, how to configure the linux machine to send the logs to the server and what're the step to be followed.  please share the method so that i can try embed the steps for automation.  Ideally, as the client machines are very high in numbers and they need to send the logs to Splunk Server, which is the recommended method (push based or pull based).  Thanks for this help with the answer.

Labels (1)
0 Karma

ravind
Observer

Quite helpful Ismo.  I am looking forward for config/requirements for getting splunk configured to send logs from a standalone app VM..  Like during docker build what are the prior steps need to be followed etc.

 

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Install a Universal Forwarder (UF) on each VM and configure them to send data to the Splunk server.  See https://docs.splunk.com/Documentation/Forwarder/9.0.2/Forwarder/Installanixuniversalforwarder for installation instructions.

Since you have a lot of machines you'll also want to set up a Splunk Deployment Server to send configuration apps to the UFs.  See https://docs.splunk.com/Documentation/Splunk/9.0.2/Updating/Aboutdeploymentserver for more.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ravind
Observer

Thank you Rich for the assistance.  It looks like the linux client is in the containerized format and deployed across multiple k8s and as a standalone container.  Installing splunk universal forwarder process still should be same (or) for different method should be availed.  Thanks for the help again

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this is one reply which you may need if you found some errors to use this in k8s. https://community.splunk.com/t5/Installation/Upgrading-Universal-Forwarder-8-x-x-to-9-x-x-does-not-w...

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...