Remote Data Collection

Abstract

So far we have been indexing data into Splunk that comes from files that are located on the same server where Splunk is installed, or from databases using the DB Connect app. With the latter, it’s pretty much transparent where the database is located, as the DB connect app—or any database client, for that matter—can easily communicate with a database over the network. In this chapter, we review how to collect data from remote servers using the Splunk forwarders. We will also go over the Splunk deployment server, which allows updating remote Splunk instances, including forwarders, and the deployment monitor app, which presents the state of all Splunk instances.