topic Re: How do I send journald logs to my Splunk indexer? in Getting Data In

How do I send journald logs to my Splunk indexer?

ctjd81 — Mon, 01 Feb 2016 15:12:27 GMT

I would like to separate these logs into units (ie - etcd.service, kube-apiserver.service, kube-controller-manager.service, etc)
I'd then like to send those different logs to Splunk.
Do I have to force these logs to a file first, then move them?

Re: How do I send journald logs to my Splunk indexer?

renjith_nair — Tue, 02 Feb 2016 06:56:38 GMT

Since splunk can't read the default binary format of journal , you should write to a text file and then forward (don't remember but read it somewhere)

There is a blog which talks about this in detail for different flavors, might be useful for you .

http://blogs.splunk.com/2015/04/30/integrating-splunk-with-docker-coreos-and-journald/

Re: How do I send journald logs to my Splunk indexer?

ctjd81 — Wed, 03 Feb 2016 18:57:57 GMT

This got me a long way to the answer, thanks!!!

Re: How do I send journald logs to my Splunk indexer?

alastor — Wed, 04 Mar 2020 19:42:14 GMT

This is a terrible answer. Splunk should put this into the TA for NIX. expecting each customer to figure out some crap method of this is BS.

Re: How do I send journald logs to my Splunk indexer?

tgurantz_splunk — Fri, 07 Oct 2022 21:58:25 GMT

Agreed... I'm going through these older journald posts for other reasons, but it looks like no one has updated responses here that there's better ways now? Starting in Splunk 8.1 there is native journald input support (separate from any TA for *NIX):

https://docs.splunk.com/Documentation/Splunk/latest/Data/CollecteventsfromJournalD