topic Re: Collect SunOS-SPARC OS Logs in Deployment Architecture

Collect SunOS-SPARC Logs

dania_abujuma — Wed, 26 Mar 2025 09:19:24 GMT

Hello Splunkers!

I am looking for a way to collect the SunOS-SPARC OS logs. After some research, I have tried to update the inputs.conf in the Splunk Add-on for Unix and Linux ( https://splunkbase.splunk.com/app/833 ), as below (this is a snippet of the config file not all of it) :

# Currently only supports SunOS, Linux, OSX. # May require Splunk forwarder to run as root on some platforms. [script://./bin/service.sh] disabled = 0 interval = 3600 source = Unix:Service sourcetype = Unix:Service index = os # Currently only supports SunOS, Linux, OSX. # May require Splunk forwarder to run as root on some platforms. [script://./bin/sshdChecker.sh] disabled = 0 interval = 3600 source = Unix:SSHDConfig sourcetype = Unix:SSHDConfig index = os # Currently only supports Linux, OSX. # May require Splunk forwarder to run as root on some platforms. [script://./bin/update.sh] disabled = 0 interval = 86400 source = Unix:Update sourcetype = Unix:Update index = os [script://./bin/uptime.sh] disabled = 0 interval = 86400 source = Unix:Uptime sourcetype = Unix:Uptime index = os [script://./bin/version.sh] disabled = 0

This didn't work and no logs were collected (I have made sure the user running Splunk forwarder has read privilege), is there any other recommendation?

Re: Collect SunOS-SPARC OS Logs

livehybrid — Wed, 26 Mar 2025 09:17:22 GMT

Hi @dania_abujuma

Just to check - have you created the "os" index on your indexers?

Are you able to see the _internal logs for these forwarders? This will help determine if the issue is sending, or receiving the data.

Do you see any reference to these inputs (and any errors?) in the $SPLUNK_HOME/var/log/splunk/splunkd.log file?

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Collect SunOS-SPARC OS Logs

dania_abujuma — Wed, 26 Mar 2025 09:26:16 GMT

Hello @livehybrid ,

Yes, I have created the "os" index in my indexer.

I can see in the _internal index logs for these hosts.