topic Re: What are some options for Forwarding OS logs from a Full Splunk Ent instance? in Splunk Enterprise

What are some options for Forwarding OS logs from a Full Splunk Ent instance?

neerajs_81 — Thu, 11 Aug 2022 14:48:47 GMT

Hi All, Splunk 101 question .

What are our options if we want to forward OS level logs ( For example: ssh user login/logout activity) from a Deployment Server to our indexer. As a DS is a full Splunk Enterprise instance, it is not recommended to put UF on the same host. Where do i need to configure to tell it to monitor the OS syslog file also ? Is it /etc/system/local/inputs.conf ? If yes, how to maintain this inputs.conf copy for updates as i assume we cannot push updates to this file from the same host itself . Any best practices here ?

My DS is currently sending _audit, _introspection logs to the Idx ; which contain info about Splunk platform and not OS.
Hope i am clear. Thank you

Re: What are some options for Forwarding OS logs from a Full Splunk Ent instance?

m_pham — Thu, 11 Aug 2022 20:26:36 GMT

It sounds like what you want is the Splunk Add-on for Unix and Linux: https://splunkbase.splunk.com/app/833/

The technical add-on (TA) will need to be installed on the DS and configured with your custom inputs.conf for the TA.

Re: What are some options for Forwarding OS logs from a Full Splunk Ent instance?

neerajs_81 — Fri, 12 Aug 2022 05:16:46 GMT

Thank you for responding. The release notes of the TA says it needs to be put on a forwarder. But DS is a full Splunk Ent install. Should we still install in the DS then ? Alternatively, would configuring the local inputs.conf of the /opt/splunk/etc/system/local directory on DS by adding monitor stanzas also work ?

Re: What are some options for Forwarding OS logs from a Full Splunk Ent instance?

m_pham — Fri, 12 Aug 2022 16:08:59 GMT

Splunk Enterprise server can forward data: https://docs.splunk.com/Documentation/Splunk/9.0.0/Forwarding/Aboutforwardingandreceivingdata#:~:text=You%20can%20forward%20data%20from,forwarding%20is%20called%20a%20forwarder.&text=A%20Splunk%20instance%20that%20receives,forwarders%20is%20called%20a%20receiver.

Best practice is for your custom inputs is in a separate addon - example: /opt/splunk/etc/apps/my_custom_app/local/inputs.conf

You should watch this to learn the basics of Splunk Administration: https://www.youtube.com/watch?v=O_w7rSWlHJs