https://community.splunk.com/t5/Getting-Data-In/How-do-I-ingest-Linux-logs-on-my-indexers/m-p/338092#M62429 <P>I am running a distributed Splunk environment. I have three indexers, an index master, a search head, and a universal forwarder deployment server. The universal forwarders load balance between the three indexers. I would like to ingest the logs like /var/log/secure/ and /var/log/messages that are on the indexers themselves so I can monitor logins and whatnot on those servers. Can I simply add the log files in question to $SPLUNK_HOME/etc/system/local/inputs.conf, on each indexer or is there a better way to attack indexing Linux logs on the indexers in the cluster? </P> Mon, 06 Mar 2017 21:00:41 GMT jrabidoux 2017-03-06T21:00:41Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-ingest-Linux-logs-on-my-indexers/m-p/338092#M62429 <P>I am running a distributed Splunk environment. I have three indexers, an index master, a search head, and a universal forwarder deployment server. The universal forwarders load balance between the three indexers. I would like to ingest the logs like /var/log/secure/ and /var/log/messages that are on the indexers themselves so I can monitor logins and whatnot on those servers. Can I simply add the log files in question to $SPLUNK_HOME/etc/system/local/inputs.conf, on each indexer or is there a better way to attack indexing Linux logs on the indexers in the cluster? </P> Mon, 06 Mar 2017 21:00:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-ingest-Linux-logs-on-my-indexers/m-p/338092#M62429 jrabidoux 2017-03-06T21:00:41Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-ingest-Linux-logs-on-my-indexers/m-p/338093#M62430 <P>You should configure the monitoring configuration, inputs.conf, to a app and deploy that app through the cluster master. See this for more information on distribution of app to indexer cluster peers from cluster master:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations">http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations</A></P> Mon, 06 Mar 2017 21:55:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-ingest-Linux-logs-on-my-indexers/m-p/338093#M62430 somesoni2 2017-03-06T21:55:22Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-ingest-Linux-logs-on-my-indexers/m-p/338094#M62431 <P>Perfect! Exactly what I was looking for. Worked like a charm!</P> <P>Many Thanks!</P> Tue, 07 Mar 2017 14:49:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-ingest-Linux-logs-on-my-indexers/m-p/338094#M62431 jrabidoux 2017-03-07T14:49:18Z