Splunk host agent.

sparc86 · 05-02-2007, 08:52 AM

Hello,

I've installed Splunk in a Debian VM. That's great to have all the local log files indexed to Splunk , but I do need to index other hosts as well. I know I could use nfs or samba for sharing these log files, but also know that I can use some kind of agent on these hosts, therefore the server can get the log files from these hosts.

I would like to know whose are these agents that I can use with Splunk and how can I implement it? I cannot find any documentation about these agents.

Thanks in advance.

acid_kewpie · 05-03-2007, 03:15 AM

you want to get standard system logs into splunk? best way would be to upgrade your syslog servers on each host pc to syslog-ng and then just add the splunk box as a udp or tcp logging destination in addition to the standard files.

the reason you can't find much infomration about agents nad such is that there are none, it's just a tweak of totally standard stuff you're already using. there is a *lot* of info about splunk and syslog-ng combined, certainly non splunk base.