Getting Data In

Where can I get application logs regarding Splunk API?

Kaushikkatta03
Explorer

One of our Web/mobile team is considering an innovation project involving Splunk integration. Basically, better tracking/early notification of errors so that we can prevent them. We’re attempting to work with the Splunk API.

What is the efficient way to access application logs? And moreover, where can we get sftp-ing log files and how to parse them manually?

0 Karma

woodcock
Esteemed Legend

Don't sftp if you can avoid it. It is FAR better to put a Universal Forwarder on the server where the logs are being written. If you have to use FTP, setup a Heavy Forwarder and build your own cron to pull the files in but do it atomically (copy them in with a temporary name/extension and once the files are down, rename them to what Splunk is expecting).

richgalloway
SplunkTrust
SplunkTrust

What application are you referring to, Splunk or something else?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Kaushikkatta03
Explorer

The only other thing I’m thinking of is sftp-ing log files off of the server and then parsing them manually, which doesn’t sound nearly as usable as the Splunk API.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...