Getting Data In

First Time Users Configuration Questions Regarding Forwarding

wdc
New Member

I've found how to get data from a remote users Security Log but we are after a centralised area to keep these logs. I then set the Splunk server to become a receiver and then a test server as a light forwarder. How do I know that it is working? Presumably this data is then stored on the Splunk server somewhere? Is this the best way to get my centralised data?

Tags (1)
0 Karma

Genti
Splunk Employee
Splunk Employee

Did you set the light forwarder to monitor anything on the "forwarding machine"? Did you set the light forwarder to send data to the indexer on some specific port? Did you set up the indexer to listen to the above port?

If so, then just logging in to you indexer should be enough to tell you that you are receiving data..

Assuming you are on unix, a cool command to tell you if you are listening on the indexer is netstat -an | grep 9997 where 9997 is the specific port where you are telling the indexer to listen.

0 Karma

Genti
Splunk Employee
Splunk Employee

eek, Mick beat me to it..

0 Karma

Mick
Splunk Employee
Splunk Employee

You'll know its working if you can search on your 'receiving' server and see data that came from your 'forwarding' server. The data should be getting indexed on the receiver, by default it will write to C:\Program Files\Splunk\var\lib\splunk\defaultdb, and in the search summary interface you should see your forwarding server listed on the list of 'Hosts' on the right-hand side.

Yes, this is the recommended solution for getting your logs into a centralized location. There are other ways to implement this, but to keep it straightforward to start with, use a Splunk instance configured as a forwarder.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...