Getting Data In

What documentation can I use as reference to set up forwarding data from my Tomcat servers to my local instance?

appzen
Path Finder

I am new to Splunk and I am trying to find the right documentation to get started. My goal is to get the logs from catalina.out from two separate servers. I have downloaded Splunk locally and I think that this must be achieved by sending data via the forward option. I am not sure on how to connect to my servers and do I need to download some splunk software to the servers as a well as locally? Thanks.

0 Karma

chanfoli
Builder

Yes, you would want to at a minimum have a full splunk instance set up on a server meeting the system requirements. This would be your indexer and search-head which you would configure to receive data on the default TCP port or a port of your choosing. Then you would install the universal forwarder on your tomcat servers, configure them to output data to your indexer's hostname/IP, and port as well as configure to monitor the files you want to start indexing.

This is pretty straight-forward stuff but it is not trivial to explain and documentation is already written to cover the process. See the following links as well as the rest of the Getting Data In and introductory section:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configureyourinputs

http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Introducingtheuniversalforwarder

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...