Getting Data In

How to add hosts to splunk server

wanted819
Engager

Hi,

I have installed splunk in centos and it is working fine.
And i have installed the universal forwarder in another host(centos).
Now i have no idea, "how to add the client host to splunk server?"

Regards,
karthi

Tags (2)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

The short answer is

On the main splunk installation (call it Indexer/Search Interface/Splunk Web); go into Manager, go into "Forwarding and Receiving", click "Enable Receiving", fill in a port number, e.g. 9997.

On the Forwarder, it's probably easiest if you simply

  • su splunk
  • /opt/splunk/bin/splunk add forward-server <IP:port>

That sets up the connection between the two hosts.

But I suggest you read up on the docs, there is a 'tutorial' section that will cover the basics, and a 'distributed deployment' section that will cover forwarding. There is also a 'getting data in' section with detailed 'recipies' for various scenarios.

http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/WelcometotheSplunkTutorial

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview

http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

Hope this helps,

K

View solution in original post

kristian_kolb
Ultra Champion

The short answer is

On the main splunk installation (call it Indexer/Search Interface/Splunk Web); go into Manager, go into "Forwarding and Receiving", click "Enable Receiving", fill in a port number, e.g. 9997.

On the Forwarder, it's probably easiest if you simply

  • su splunk
  • /opt/splunk/bin/splunk add forward-server <IP:port>

That sets up the connection between the two hosts.

But I suggest you read up on the docs, there is a 'tutorial' section that will cover the basics, and a 'distributed deployment' section that will cover forwarding. There is also a 'getting data in' section with detailed 'recipies' for various scenarios.

http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/WelcometotheSplunkTutorial

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview

http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

Hope this helps,

K

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...