topic Re: I need assistance on inputs.conf syntax for Linux log ingestion in All Apps and Add-ons

I need assistance on inputs.conf syntax for Linux log ingestion

Jarohnimo — Tue, 23 Jan 2018 21:38:20 GMT

Hello All,

I'm new to linux. I have experience using the deployment server and creating my own apps in Splunk to receive information sent to the index of my choice. I have a new requirement to fetch some linux data where I'm not too familiar and would like some assistance on the basic syntax for the deployment apps. Can someone please provide syntax examples for the deployment apps for the logs specified below so I can familiarize myself.

var/log/messages

var/log/secure

var/log/boot.log

var/log/yum.log

var/log/audit/(all files)

var/log/sa/(all files)

var/log/firewalld

I have the tomcat app however that setup process seems to be different and doesn't support deployment apps.

Please let me know if there are other apps I can use to make this process easier or if creating my own apps are best. Thank you!

Re: I need assistance on inputs.conf syntax for Linux log ingestion

FrankVl — Wed, 24 Jan 2018 09:00:58 GMT

Have a look at Splunk TA-nix: https://splunkbase.splunk.com/app/833/

This also includes a sample inputs.conf file if I recall correctly. That should give some inspiration (although likely needs tuning for the specific files as they exist on your linux box(es). That should also point you at what sourcetype to use.

But (assuming you have a splunk forwarder installed on the linux box(es)) basically you just need to create some file monitor inputs, see inputs.conf reference documentation for syntax.

Re: I need assistance on inputs.conf syntax for Linux log ingestion

sapanda — Wed, 30 Jan 2019 05:19:21 GMT

Hello @Jarohnimo ,

Below are a few links which will help you understand how to setup the inputs.conf file for you app to get data for Linux log messages into your splunk enterprise.

https://docs.splunk.com/Documentation/Splunk/7.2.3/Updating/Exampleaddaninputtoforwarders

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&utm_medium=in-answer&utm_term=inputs.conf&utm_campaign=refdoc

https://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/DeploytheSplunkAdd-onforUnixandLinuxinadistributedSplunkenvironment

Hope this helps.

Thanks,
Sapan