How can I configure splunk with log files residing on remote unix servers?
Normally I log into putty to a linux server, from there I ssh into another company server and I navigate through directories and perform my operations mainly as
zcat etc., with grep filters. Ex:
- login to example_server with putty
- ssh to ssh_server
- cd to req dir
- perform cat etc.,
ssh_server will not directly allow to be logged in from putty, I have to first login to example_server and then to ssh_server.
How can I configure these log files to be used by splunk to search for a string, similarly to how I use grep. I've installed splunk on my laptop, and by clicking
add data > files and
dir > add new it shows full path to the data field, what path should I fill it with?
1) I can't do any modification to server(have no rights), so i couldn't use splunk universal forwarder 2)There's no way i can open port to write to and make splunk listen to it, as i said my higher-ups won't allow, if something goes wrong, it will cost my job if there's anyway i can write to port securely ,that might help. 3) I can run shell scripts FYI 4)It will help if anyone suggest how i can securely connect to log servers, download data files(not manually) a python script or .bat file, and will use this local directory in splunk :)