https://community.splunk.com/t5/Deployment-Architecture/linux-logs-to-splunk/m-p/397762#M14409 <P>Which apps have you included in the server class? Do any of them include inputs.conf? What are the inputs.conf settings? Is there an outputs.conf that tells the forwarder where the indexers are? Have you verified the apps are installed on the forwarder?</P> Tue, 16 Jul 2019 12:57:26 GMT richgalloway 2019-07-16T12:57:26Z https://community.splunk.com/t5/Deployment-Architecture/linux-logs-to-splunk/m-p/397761#M14408 <P>Hi Friends, </P> <P>I am trying to add Linux logs in Splunk, Created server class and added the app details. completed all the basic steps but still i cant find the data in splunk head . below you can find the sample logs from server. Anyone please suggest me config file for the same .</P> <P>Sample log format :</P> <P>01:00:07.703 STATUS: TRelease: TRACK: 201907160100NASDAQ_<EM>NDE</EM>__<STRONG><EM>1000252590</EM> en-synd1_0_3001.hld being marked ready for delivery.<BR /> 01:00:07.703 STATUS: TRelease: TRACK: Leaving shm_keydist_check_response(): re ady count = 1<BR /> 01:00:07.703 STATUS: TRelease: TRACK: 1 responses are ready to process.<BR /> 01:00:07.703 STATUS: TRelease: TRACK: Preparing release files for 201907160100 NASDAQ</STRONG>NDE___<STRONG>_1000252590_en-synd1_0_3001.hld. Received all 1 replies back.<BR /> 01:00:07.704 STATUS: TRelease: TRACK: prepare_release_list()<BR /> 01:00:07.704 STATUS: TRelease: TRACK: add_in_serials() Added 2 serial numbers<BR /> 01:00:07.704 STATUS: TRelease: TRACK: Serial 3001: delivered release file: 201 907160100NASDAQ</STRONG>NDE___<STRONG>_1000252590_en-synd1_0_3001.rls.<BR /> 01:00:07.706 STATUS: TRelease: TRACK: Serial 3002: delivered release file: 201 907160100NASDAQ</STRONG>NDE___<STRONG>_1000252590_en-synd1_0_3001.rls.<BR /> 01:00:07.707 STATUS: TRelease: TRACK: shm_keydist_clear_slot_by_id(0) - 201907 160100NASDAQ</STRONG>NDE___<STRONG>_1000252590_en-synd1_0_3001.hld<BR /> 01:00:07.794 STATUS: TsynDg1-1: TRACK: shm_keydist_update_sent() - 2019071601 00NASDAQ</STRONG>NDE______1000252594_en-synd1_0_3001.hld<BR /> 01:00:07.794 STATUS: TsynDg1-1: TRACK: find_slot_by_filename(201907160100NASDA </P> Wed, 30 Sep 2020 01:23:11 GMT https://community.splunk.com/t5/Deployment-Architecture/linux-logs-to-splunk/m-p/397761#M14408 niranjan28 2020-09-30T01:23:11Z https://community.splunk.com/t5/Deployment-Architecture/linux-logs-to-splunk/m-p/397762#M14409 <P>Which apps have you included in the server class? Do any of them include inputs.conf? What are the inputs.conf settings? Is there an outputs.conf that tells the forwarder where the indexers are? Have you verified the apps are installed on the forwarder?</P> Tue, 16 Jul 2019 12:57:26 GMT https://community.splunk.com/t5/Deployment-Architecture/linux-logs-to-splunk/m-p/397762#M14409 richgalloway 2019-07-16T12:57:26Z https://community.splunk.com/t5/Deployment-Architecture/linux-logs-to-splunk/m-p/397763#M14410 <P>Hi niranjan28,<BR /> can you please describe your setup?<BR /> Is there a Splunk Universal Forwarder sending data to your Indexer?<BR /> If yes: Does it get listed in your Monitoring Console correctly?<BR /> Kind regards,<BR /> Michael</P> Tue, 16 Jul 2019 13:56:07 GMT https://community.splunk.com/t5/Deployment-Architecture/linux-logs-to-splunk/m-p/397763#M14410 jutzasconsist 2019-07-16T13:56:07Z