Getting Data In

Indexing logs to remote server

eippops
New Member

I have installed 1 forwarder on my linux machine-1 and another on windows apache machine-2. The splunk has been installed on another windows machine-3. i was able to enable the receiving and am able to view forwader in splunk.
Now i need to monitor my apache logs from machine-1 and application logs from machine-2 from the remote machine-3 where splunk is installed. I have read the documentations, but it didnt helped me much.
What entry need to be made in outputs.conf on forwader and inputs.conf on splunk for this requirement.

0 Karma

aholzer
Motivator

This is a general guideline of where the different conf files should live. If you need more details I suggest you re-read the documentation with this guideline in mind. Good luck.

inputs.conf needs to be defined on both the forwarders and the indexers.

  • On the forwarders it needs to define what you are monitoring and what index to write to
  • On the indexer it needs to define the port and such that it needs to listen at

outputs.conf needs to be defined on the forwarders

  • It needs to define what indexer it will write to

props.conf needs to be defined on the indexer

  • It needs to define how to parse the data by sourcetype that it receives

indexes.conf needs to be defined on the indexer

  • It needs to define the basic information for where the data should be stored
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...