Hi all,
we have an ELK-cluster in our company and now we want to have the data, we have in ELK, as well in Splunk. Installing splunk Forwarders on the servers to monitor is not an option unfortunately.
We don't want to query Kibana from Splunk and import those results into Splunk; we want the raw logs.
Has anyboy of you experiences with configuring logstash-forwarders, to send the data as well to the Splunk Indexers?
We are thinking as well of shipping the logs to a file on a syslog-server where a UF can pick them up and forward them to the indexers - but maybe there is something more elegant?
Thanks,
Yannic
... View more