Implementing Splunk - Second Edition

Common data sources

Your data may come from a number of sources; these can be files, network ports, or scripts. Let's walk through a few common scenarios.

Monitoring logs on servers

In this scenario, servers write their logs to a local drive, and a forwarder process monitors these logs. This is the typical Splunk installation.

The advantages of this approach include:

• This process is highly optimized. If the indexers are not overworked, events are usually searchable within a few seconds.
• Slowdowns caused by network problems or indexer overload are handled gracefully. The forwarder process will pick up where it left off when the slowdown is resolved.
• The agent is light, typically using less than 100 megabytes of RAM and a few percent of one CPU. These ...