if the logs are in the same server in the folder
/mylog/ftp/ and look like myftp.log (or myftp.log.1 or myftp.log.2.gz etc...)
Collect a sample and index it using the manager, it will help you figure the best sourcetype configuration (linebreak parsing, timestamp detection...)
Then once done create a monitor input on the folder/logfile using the manager or the configuration file.
[monitor:///mylog/ftp/myftp.*]
sourcetype=mysourcetypefortmyftp
If the log files are not on the same server than your splunk indexer, then you can install the universal forwarder as an agent on the box that has the logs (and make sure to define the sourcetype in props.conf on the indexer).
Or an alternative is to use a network mount for the log folder no the splunk indexer.
if the logs are in the same server in the folder
/mylog/ftp/ and look like myftp.log (or myftp.log.1 or myftp.log.2.gz etc...)
Collect a sample and index it using the manager, it will help you figure the best sourcetype configuration (linebreak parsing, timestamp detection...)
Then once done create a monitor input on the folder/logfile using the manager or the configuration file.
[monitor:///mylog/ftp/myftp.*]
sourcetype=mysourcetypefortmyftp
If the log files are not on the same server than your splunk indexer, then you can install the universal forwarder as an agent on the box that has the logs (and make sure to define the sourcetype in props.conf on the indexer).
Or an alternative is to use a network mount for the log folder no the splunk indexer.
What ftpd are we talking about? Do you have log samples?
You have a splunk forwarder on the FTP server currently? That is the most straightforward way to monitor any logs on that or any server. Is there an issue or are you just looking for another way?