I have a web application that is split over a couple of sites in the US and the UK. When we have issues I would like to be able to view the collated error logs from the 2 sites.
So I was thinking about doing this
1)setting up a splunk server at each site
2)setting 1 as a forwarder to the other
3)forwarding all error syslogs and warnings from site 1 to site 2
and when there was a problem, I would import all the apache logs from site 1 into the local splunk at it would forward them to site 2 for analysis with all the existing logs.
Q1) Is this reasonable using the splunk free license?
Q2) is it reasonable to send server syslogs that are at the error and warning level over the internet? ie performance and bandwidth wise