Getting Data In

How to feed Splunk with remote custom input?

mxmauro
Engager

Hi,

I want to create an app to feed a Splunk server with my custom data. I saw in C# sdk I can build a ModularInput application and install it on the main server.

But I don't understand how to do the same on remote machines. I installed the universal forwarder in another computer to begin my tests but don't know:

  1. How to link my app with the universal forwarder or create an app to directly feed a remote server.
  2. How to start my app installed on a remote computer from the main server.

Thanks,
Mauro.

0 Karma

strive
Influencer

Assuming you can reach your remote machine from the main server, here you go

  1. You can create an app that gets deployed on universal forwarder and takes care of log forwarding. You can use deployment server to deploy app on your other machine.
  2. In the forwarder app that you have created, you need to configure inputs.conf and outputs.conf to monitor and to forward logs respectively.
  3. To deploy apps on other systems you need to configure serverclass.conf

The following are the links that will help you with all the configurations that you need to do

Deploy Apps to clients - http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Updateconfigurations
Deployment Server and Forwarder Management - http://docs.splunk.com/Documentation/Splunk/6.1.2/Updating/Aboutdeploymentserver

Getting data in using forwarders - http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/Usingforwardingagents
Wiki link with many topics - http://wiki.splunk.com/Community:Getting_data_into_Splunk

If you have already tried some of these then post your configurations. Splunkers will help you.

mxmauro
Engager

Hi Strive, do you have any sdk documentation about how to link a modularinput app to the universal forwared, if it is really needed?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...