topic Re: Where are the inputs to my system? in Getting Data In

Where are the inputs to my system?

gerryha — Sat, 22 Oct 2022 00:13:39 GMT

I'm looking at this screen - it says "Data inputs" but lists a bunch of splunk home folders.

I thought splunk home would be where the data goes to, not where it comes from. I consider an "input" to be a "from", so makes no sense to me for splunk to be there.

I was expecting to see a bunch of systems and their log files as inputs, yet so far I cannot find any of (I just got admin and our splunk system seems to have a lot of everything, so it must be hidden in there somewhere).

I've looked at the "Datasets" - 168 of them and none seem to be what I am looking for.

Re: Where are the inputs to my system?

ITWhisperer — Sat, 22 Oct 2022 06:27:25 GMT

Files and directories are just one of the ways of getting data into splunk indexes. What you may be after is the sources for the events in the indexes - try something like this

index=* | stats count by source

Re: Where are the inputs to my system?

gcusello — Sat, 22 Oct 2022 09:36:57 GMT

Hi @gerryha,

answering to your questions, you have a list of H$SPLUNK_HOME folders because you're seeing the inputs of internal logs of the present server that depend on the installation path of you Splunk instance.

Infact you haven't only $SPLUNK_HOME folders but also a different one, if you search surely you'll find othe r input different than $SPLUNK_HOME.

But usually few inputs arrive from the Splunk instance and in [Settings > inputs] you can only see the local inputs, to see all the inputs you have to see the inputs in the addon-ons that you deployed to your Universal and Heavy Forwarders.

To see them you should see in the apps located in Deployment Server at the folder $SPLUNK_HOME/etc/deployment-apps.

To see the sources of the logs that you ingested you can use the search hinted by @ITWhisperer , that I'd simplify using | metasearch:

| metasearch index=* | stats count BY host source

In addition I think that is also relevant for you the host where the input is located, for this reason I added also host to the previous search.

Then, when you say "Full path to your data", it indicates the path "to reach" your data, but I could be agree with you that maybe "from" could be more correct.

Ciao.

Giuseppe