Hello,
I have Splunk instance configured on my linux machine. I want to fetch log files from remote server where all the log files resides which is again a linux machine.
My understanding is to install Splunk forwarder on remote server which will push log files to my machine where I have configured the splunk instance. Is it correct?
Thanks.
Yes this would be the recommended method. You should read the documentation, it will help in understanding this part of a distributed deployment:
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Aboutforwardingandreceivingdata
There are other methods like transferring the files locally/network traffic/scripted inputs. However the forwarder is the definately the recommended method for remote data collection, and it's quite easy to set-up using the documentation above
Thanks for the confirmation.