Getting Data In

Files and directories - remote

The easiest way to get data from remote machines into Splunk Enterprise is with the universal forwarder. You set up the forwarder on the machine that generates the data and then point the forwarder at the Splunk Enterprise indexer. The forwarder gets the data and forwards the events to the indexer, which then processes and stores them and makes them available for searching.

There are two steps:

1. Set up the forwarder on the remote machine and point it at the indexer. See this recipe: "Forwarders".

2. Set up the forwarder inputs so that they monitor the data. This process is the same as if the data was on a Splunk indexer. However, the forwarder does not have Splunk Web, so you must set up the inputs either with the CLI or by editing inputs.conf directly.

• For information on setting up inputs to monitor files, see "Monitor files and directories" in this manual.
• For additional information on how to set up forwarders, see "Use forwarders to get data" in this manual.