How can I get notifications.log from the Leader Node, and forward them to Splunk?
Hello, How can I get notifications.log from the Leader Node, and forward them to Splunk?
Answers
-
Install a Splunk UF on the leader or install a Cribl Edge agent on the leader - one of those can forward the leader's logs on
0 -
So there is no way to forward it with the help of the Leader? There would be an option to send it from workers via Splunk HEC though. But trying to see if Cribl Leader is of any help in this matter
0 -
Edge is preferred, of course :slightly_smiling_face:
0 -
Leaders don't transport data
0 -
you can query the API
0 -
using REST Collector
0 -
Worker -> REST call to Leader -> send results
0 -
And if I have more than one Worker, would it result in duplicates?
0 -
no. REST Collections are coordinated by ... the leader
0 -
Okay. Thanks a lot!
0 -
One solution is to create a REST API Collector Collect URL = `http://leader:9000/api/v1/system/logs/notifications.log` And in the Authentication use the ' Login ' option to obtain the bearer token At that point you can forward the data to Splunk
0
