How to configure sending logs from suse linux virtual machine to Splunk Server?

[ravind]

Hi Team,  I just need to send logs from linux client machine (Suse linux) to the Splunk Server hosted in a remote datacenter.  I would like to ask, how to configure the linux machine to send the logs to the server and what're the step to be followed.  please share the method so that i can try embed the steps for automation.  Ideally, as the client machines are very high in numbers and they need to send the logs to Splunk Server, which is the recommended method (push based or pull based).  Thanks for this help with the answer.

[ravind]

Quite helpful Ismo.  I am looking forward for config/requirements for getting splunk configured to send logs from a standalone app VM..  Like during docker build what are the prior steps need to be followed etc.

Thanks

[richgalloway]

Install a Universal Forwarder (UF) on each VM and configure them to send data to the Splunk server.  See https://docs.splunk.com/Documentation/Forwarder/9.0.2/Forwarder/Installanixuniversalforwarder for installation instructions.

Since you have a lot of machines you'll also want to set up a Splunk Deployment Server to send configuration apps to the UFs.  See https://docs.splunk.com/Documentation/Splunk/9.0.2/Updating/Aboutdeploymentserver for more.

[ravind]

Thank you Rich for the assistance.  It looks like the linux client is in the containerized format and deployed across multiple k8s and as a standalone container.  Installing splunk universal forwarder process still should be same (or) for different method should be availed.  Thanks for the help again

[isoutamo]

Hi

this is one reply which you may need if you found some errors to use this in k8s. https://community.splunk.com/t5/Installation/Upgrading-Universal-Forwarder-8-x-x-to-9-x-x-does-not-w...

r. Ismo