Splunk logging on multiple dynamic instances
I have an application of which new server instances would be increasing upon increasing load.
Now as per app config - the log files would remain physically inside these newly created server instances.
How can I feed logs of these newly created server instances to Splunk?
Should I log at a common known location for ALL of these newly created server instances?
OR
there is a better approach. Please advice. Thanks.
The preferred way is to install the Splunk Universal Forwarder (UF) on each server instance and have the UF send the logs to Splunk.