topic Re: Documentation for journald_input in Getting Data In

Documentation for journald_input

opoplawski — Thu, 17 Nov 2022 16:50:56 GMT

I see that there is a journald_input app in the splunk forwarder install, but I can't seem to find any information on how to use it. I ran:

/opt/splunkforwarder/bin/splunk enable  app journald_input

But it doesn't appear to be ingesting any entries from the journal.

Re: Documentation for journald_input

richgalloway — Thu, 17 Nov 2022 18:35:43 GMT

The app is enabled, but is an input enabled (they're separate)? Use btool to check

splunk btool inputs list --app=journald_input

or examine the inputs.conf files

less /opt/splunkforwarder/etc/apps/journald_input/default/inputs.conf /opt/splunkforwarder/etc/apps/journald_input/local/inputs.conf

Re: Documentation for journald_input

opoplawski — Thu, 17 Nov 2022 20:32:08 GMT

Ah, thanks. I guess /opt/splunkforwarder/etc/apps/journald_input/README/inputs.conf.spec is the reference then. It also wasn't entirely clear to me that the "<name>" for the input appears to be arbitrary.

Unfortunately for the moment, it looks like this will not work on EL7 as it uses the --output-fields option to journalctl which is not present there.