Is it possible to validate whether or not Splunk Light is working without accessing Splunk Web?

[Monica7]

Is it possible to validate Splunk Light (whether it is working or not) without accessing Splunk Web.

I am going to install Splunk Light Linux version in server1 and Splunk universal forwarder in server2. I am not going to install Splunk Light Windows version in server1.

Is there any way to check whether Splunk Light is working or not, only with the Linux version in both servers?

[jterry]

" wont be internet connection to access front end splunk url."

• If there's no internet connectivity between you & the host that has the info you want, then there's no hope. If you mean that there's simply no web access from your windows system to the linux-splunk host then if the linux-splunk host can send email, you could possibly schedule a search on the splunk-linux host that would send reports to you via email on a regular basis.

[Monica7]

How can I check the remote server logs in my Linux machine(where splunk light is installed)?

[jterry]

please see my earlier answer

[Monica7]

hi any updates on this question

[jterry]

...not real sure i understand the issue but i'm guessing you want to search some data w/out using the ui. If that's the case then perhaps start w/this:

"splunk help search"

[jterry]

If you care to post details about your use-case & topology (what's being monitored, where splunk & it's forwarders are installed, what access/network restrictions are in place) then i might have a better answer for you.

[Monica7]

Actually I have to do splunk light implementation in two remote servers (A & B)where I can use only Linux boxes. I cannot access Windows there And there wont be internet connection to access front end splunk url.

So in one remote server A, I will install splunk light(Linux version) in Linux box . And In another remote server B , I will install universal forwarder(Linux version) in that Linux box.

Thing is I have to track the linux logs of remote server B in Remote server A. Since we have installed universal forwarder in remote server B, It will forward the logs to remote server A.

If I have windows version of splunk light or using UI(http://localhost:8000/), we can check the logs in home screen. As I couldn't able to access windows there, how can I check the logs of remote server B in remote Server A Linux box.is it possible?

[jterry]

"splunk add monitor remote-server-logs-where-splunk-is-installed" ?

[Monica7]

yeah in which path it will add the remote server logs in the server where splunk is installed?Actually i have to monitor the remote server logs in linux machine of splunk where it is installed without checking in splunk web(http://localhost:8000/). Is it possible?