Splunk Search

Which platforms does Splunk support?

ngvcuong
New Member

Hi all,
As my title, Im going to install splunk on windows server, but i wonder that can it collect all log from differents platforms ( Linux, Unix, Windows and other network- firewall devices )?
Thanks for all answers !

Tags (1)
0 Karma

MHibbin
Influencer

ngvcuong,

I think the saying, "Where there's a will, there's a way", is relevant here... Splunk can index data from a LOT of different sources. I think you should start by reading the following documentation...

http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

But in response to you question, if you are looking to index logfiles (e.g. "/var/log"), it would be best to install a Splunk forwarder (light or universal) and have that forward your data to the Splunk index.

For network based devices, Splunk can index data transmitted over the network (e.g. syslog on UDP/514), but a better solution would be to have your network devices export the data/logs to a syslog server (e.g. syslog-ng) and then forward the data with another instance of a Splunk forwarder (this will allow more/easier control over sourcetyping, etc). Below are some interesting reads that should get you started...

Splunk Forwarders:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Usingforwardingagents

Splunk Distributed Overview (where there are multiple installations of Splunk):

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Distributedoverview

Splunk Best Practice for Syslog (Community Wiki):

http://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input

Hope this helps answer your question, and gets you started.

Regards,

MHibbin

P.S. If this answers your question please mark it as "Accepted" (the tick to the left) and/or "UpVote"

lguinn2
Legend
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...