Hi,
I am a newbie to Splunk. My requirement is to generate reports against Database on a daily basis using Splunk. We need to do this by generating logs on DB in every predefined interval and forward them to splunk. To achieve this,
1. what forwarder we need to use?
2. How to configure it ?
3. Can splunk itself fetch logs from DB?
4. How much logs data we can store in splunk?
5. Can we monitor a directory for logs and use them in splunk instead of using forwarder? If it is so how to configure it?
Also let me know what options are available to achieve this.
Thanks in advance.
Regards,
Shyam
For a starting tutorial on monitoring Oracle with Splunk, try Log File Analysis for Oracle 11g. It describes most of the things you are asking about. If your Splunk installation will not be located on the same server as your Oracle database and SQL commands through DB Connect will not work to get the data you need, then you will also need to look at using the Universal Forwarder.