Understanding Splunk data inputs
Splunk Enterprise accepts any text data from a variety of sources such as computers, network devices, Internet-of-Things (IoT) devices, sensors, virtual machines, containers, databases, and so the list goes on. The source just needs to find the right data input type to ingest its text data into Splunk.
Data input types are a mechanism for forwarding data from the source to Splunk for indexing. Splunk offers the following five types of data inputs that work for most sources. In Chapter 9, Splunk Data Inputs, we’ll go through input types in more detail:
- File and directory monitoring: Sources containing data in files and lists of files inside directories can be monitored for indexing. Here, files are monitored continuously as data is appended to the end of a file. Usually, a Universal Forwarder (UF) agent runs on the source system and monitors the files and directories. A UF offers another option to index files, called
Batch, which is...
