topic How to edit my configurations to fetch the client logs from VM to Splunk Enterprise? in Getting Data In

How to edit my configurations to fetch the client logs from VM to Splunk Enterprise?

gautami433806 — Mon, 26 Dec 2016 07:46:55 GMT

i have configured Splunk Enterprise in my local and universal forwarder in my VM.
now i need to fetch the tomcat logs from VM to my local splunk

i have configured the Splunk inputs.conf as below:

[default]
host = PC316522

[tcp://:9997]
connection_host=dns

and serverclass.conf as below:

[serverClass:Universal Forwarders:app:sendtoindexer]
restartSplunkWeb = 0
restartSplunkd = 0
stateOnClient = enabled

[serverClass:Universal Forwarders:app:Splunk_TA_windows]
restartSplunkWeb = 0
restartSplunkd = 0
stateOnClient = enabled

[serverClass:Universal Forwarders]
whitelist.0 = 10.223.68.78

and in my VM, inputs.conf:

[default]
host = CTSC00637603501

[monitor://D:\TOMCAT8\apache-tomcat-8.0.26-windows-x64\apache-tomcat-8.0.26\logs]
disabled=false

and outputs.conf as below:

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.226.217.238:8089

[tcpout-server://10.226.217.238:8089]
disabled=false
 and deploymentclient.conf as below:

[deployment-client]
phoneHomeIntervalInSecs = 1800

[target-broker:deploymentServer]
targetUri = 10.226.217.238:8089
phoneHomeIntervalInSecs = 1800

But while searching for logs in Splunk, am not getting the client tomcat logs, could you please help me on this.

Thanks,
Gautami. K

Re: How to edit my configurations to fetch the client logs from VM to Splunk Enterprise?

alemarzu — Mon, 26 Dec 2016 13:06:39 GMT

Hi Gautami, does your UF have read access on that directory ?

Re: How to edit my configurations to fetch the client logs from VM to Splunk Enterprise?

gjanders — Tue, 27 Dec 2016 09:50:24 GMT

Perhaps you want to use splunktcp:// on your indexer ?

As per the inputs.conf documentation

The following configuration listens on TCP port 9996 for
Splunk cooked event data from ANY splunk forwarder.
The host of the data is set to the host name of the remote server ONLY IF the
remote data has no host set, or if it is set to "localhost".

[splunktcp://:9997]

Note that I've changed the port to 9997. The above will setup the inputs.conf to listen for Splunk universal forwarder data which is likely what you want to do...

Then refer to outputs.conf.example within the outputs.conf documentation...(your outputs needs to be changed as well)