topic Re: Configure index and application in Universal forwarder in Getting Data In

Configure index and application in Universal forwarder

skomath — Thu, 18 Apr 2013 12:18:54 GMT

I configured Universal forwarder to push the windows event logs ( adfs logs ) to main splunk server.

Can anyone help me how to configure the application and indexer.

Thanks in advance

Re: Configure index and application in Universal forwarder

skomath — Thu, 18 Apr 2013 13:47:33 GMT

Platform : windows

Re: Configure index and application in Universal forwarder

jstockamp — Thu, 18 Apr 2013 14:04:13 GMT

A little more information would be helpful .... what app, what index, what specifically do you need help with? You might want to take a look at the Splunk App for Active Directory (http://splunk-base.splunk.com/apps/51338/splunk-app-for-active-directory) as it will do most of the configuration for you.

Re: Configure index and application in Universal forwarder

skomath — Thu, 18 Apr 2013 14:10:35 GMT

In splunk web we can add new application ( say myApp ) right. And I created new index as well ( called myIndex). And the in our application server I installed unversal forwarder and configured to push adfs logs. Logs are moving to main index.

Re: Configure index and application in Universal forwarder

skomath — Thu, 18 Apr 2013 14:13:47 GMT

Do you want any more details ?

Re: Configure index and application in Universal forwarder

skomath — Thu, 18 Apr 2013 14:16:04 GMT

I want to move all logs to specific index ( say myIndex ) rather than going to main index

Re: Configure index and application in Universal forwarder

skomath — Thu, 18 Apr 2013 14:21:15 GMT

Wev are looking for the ADFS monitoring. Splunk App for Active Directory supports ADFS ?

Re: Configure index and application in Universal forwarder

jstockamp — Thu, 18 Apr 2013 14:33:03 GMT

To specify the index you want an input to go to just add:

index=myIndex

to the monitor stanza in your inputs.conf (on the forwarder).

I don't believe Splunk for AD supports ADFS logs specifically.

Re: Configure index and application in Universal forwarder

skomath — Thu, 18 Apr 2013 14:38:43 GMT

which location ? which file, Is it inputs.conf ?

Re: Configure index and application in Universal forwarder

jstockamp — Thu, 18 Apr 2013 14:43:30 GMT

It sounds like you were already configured the forwarder to push ADFS logs (which means you configured an inputs.conf file to monitor a directory). In that inputs.conf add index=myIndex and you should be good. there can be multiple inputs.conf files on a forwarder, so you could have configured it in a number of places.

Re: Configure index and application in Universal forwarder

skomath — Fri, 19 Apr 2013 06:16:17 GMT

ADFS will write the logs into windows event log. I configured the unversal forwarder to collect log from the windows event log. For installation I used the windows msi setup.

Re: Configure index and application in Universal forwarder

skomath — Fri, 19 Apr 2013 09:43:15 GMT

I specified like this

[WinEventLog:Security]
disabled = 0
index = myIndex
All the security logs start moving to the specified index.

Now the problem is... I want to filter the security logs before pushing to the server. Like I want to push only the logs having SourceName=AD FS 2.0 Auditing

Re: Configure index and application in Universal forwarder

Ayn — Fri, 19 Apr 2013 10:54:49 GMT

http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

Re: Configure index and application in Universal forwarder

jstockamp — Fri, 19 Apr 2013 13:45:54 GMT

Just to be clear these modifications to props.conf and transforms.conf will go on the indexer, not the forwarder.

Re: Configure index and application in Universal forwarder

skomath — Fri, 19 Apr 2013 14:57:47 GMT

So, Is it possible to do the filtering at client side ( in Universal forwarder ) ?

Re: Configure index and application in Universal forwarder

aholzer — Fri, 19 Apr 2013 15:16:03 GMT

see http://splunk-base.splunk.com/answers/39231/filtering-with-a-uf-before-indexing for answers to your above question

Re: Configure index and application in Universal forwarder

Ayn — Fri, 19 Apr 2013 15:16:36 GMT

No, it is not.