ngvcuong,
I think the saying, "Where there's a will, there's a way", is relevant here... Splunk can index data from a LOT of different sources. I think you should start by reading the following documentation...
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor
But in response to you question, if you are looking to index logfiles (e.g. "/var/log"), it would be best to install a Splunk forwarder (light or universal) and have that forward your data to the Splunk index.
For network based devices, Splunk can index data transmitted over the network (e.g. syslog on UDP/514), but a better solution would be to have your network devices export the data/logs to a syslog server (e.g. syslog-ng) and then forward the data with another instance of a Splunk forwarder (this will allow more/easier control over sourcetyping, etc). Below are some interesting reads that should get you started...
Splunk Forwarders:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Usingforwardingagents
Splunk Distributed Overview (where there are multiple installations of Splunk):
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview
Splunk Best Practice for Syslog (Community Wiki):
http://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input
Hope this helps answer your question, and gets you started.
Regards,
MHibbin
P.S. If this answers your question please mark it as "Accepted" (the tick to the left) and/or "UpVote"
