Getting Data In

What documentation can I use as reference to set up forwarding data from my Tomcat servers to my local instance?

appzen
Path Finder

I am new to Splunk and I am trying to find the right documentation to get started. My goal is to get the logs from catalina.out from two separate servers. I have downloaded Splunk locally and I think that this must be achieved by sending data via the forward option. I am not sure on how to connect to my servers and do I need to download some splunk software to the servers as a well as locally? Thanks.

0 Karma

chanfoli
Builder

Yes, you would want to at a minimum have a full splunk instance set up on a server meeting the system requirements. This would be your indexer and search-head which you would configure to receive data on the default TCP port or a port of your choosing. Then you would install the universal forwarder on your tomcat servers, configure them to output data to your indexer's hostname/IP, and port as well as configure to monitor the files you want to start indexing.

This is pretty straight-forward stuff but it is not trivial to explain and documentation is already written to cover the process. See the following links as well as the rest of the Getting Data In and introductory section:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configureyourinputs

http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Introducingtheuniversalforwarder

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...