Getting Data In

Installing Splunk as Indexer

traillz
New Member

I am interested in using Splunk! as an indexer, but would like to query other servers/controllers in the network for specific information. Is this possible with 4.2.1 Forwarder?

We are looking to take our Splunk installations down from every server (250+) to one server that queries other servers remotely.

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

If I understand the question, the answer is yes.

A possible implementation would be:

  1. Install a single Splunk indexer on a Linux or Windows server.

  2. Install the Splunk Universal Forwarder on each [production] server that you want to monitor. Configure each forwarder to send the appropriate data to the Splunk indexer.

You could call this the "push" method. As events happen on the production servers, the information is forwarded and indexed. The events will be searchable on the indexer almost immediately after they occur (depending on network latency etc etc)

If you want a single indexer to "pull" data from the production servers, without installing the Splunk forwarders on the production servers, the answer is maybe - but you probably don't want to do it that way. Splunk can do remote WMI for Windows servers, but it is actually faster to use the Universal Forwarder in most cases. And there are other ways to set up your environment, too, using network inputs and/or scripted inputs.

I would not generally recommend an environment where a single server polled all the production servers, with no agent software on the production servers, whether for Splunk or anything else. I think you could have some issues with performance, latency, resilience, restart/recovery, etc. -- problems that the Universal Forwarder has already solved for you,

View solution in original post

lguinn2
Legend

If I understand the question, the answer is yes.

A possible implementation would be:

  1. Install a single Splunk indexer on a Linux or Windows server.

  2. Install the Splunk Universal Forwarder on each [production] server that you want to monitor. Configure each forwarder to send the appropriate data to the Splunk indexer.

You could call this the "push" method. As events happen on the production servers, the information is forwarded and indexed. The events will be searchable on the indexer almost immediately after they occur (depending on network latency etc etc)

If you want a single indexer to "pull" data from the production servers, without installing the Splunk forwarders on the production servers, the answer is maybe - but you probably don't want to do it that way. Splunk can do remote WMI for Windows servers, but it is actually faster to use the Universal Forwarder in most cases. And there are other ways to set up your environment, too, using network inputs and/or scripted inputs.

I would not generally recommend an environment where a single server polled all the production servers, with no agent software on the production servers, whether for Splunk or anything else. I think you could have some issues with performance, latency, resilience, restart/recovery, etc. -- problems that the Universal Forwarder has already solved for you,

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...