Deployment Architecture

Forward logs from multiple Linux servers

kkossery
Communicator

Experts,

We have a enterprise product running on Red Hat Linux running on about 40 servers and want to forward logs from a non-standard location quickly and efficiently. I know we can use Splunk Forwarder to push logs out. Is there a way to pull logs from splunk rather than push from the clients. I'm looking for a way out where we don't have individually log in to each system and install the forwarder.

Thank you.

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi kkossery,

No, Splunk does not support pull method for remote logs out of box ..... but you could do it in different ways:

  • rsync the logs from the indexer and read the files from there
  • NFS mount the source files and index them from there

Anyhow, best way to do it, is using the universal forwarder and forward logs to the indexer.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

you can use puppet to install the universal forwarder - the lesser 'hard way' 😉

0 Karma

kkossery
Communicator

Thank you. I guess I'll have to do the hard way of deploying the agent on all my systems.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...