topic Re: Does Splunk Universal Forwarder forward audit events in Getting Data In

Does Splunk Universal Forwarder forward audit events

ankithreddy777 — Fri, 11 Jan 2019 15:28:32 GMT

Does Splunk Universal Forwarder forward audit event logs to Splunk _audit index?
I can see Splunk HF's are forwarding audit events, but couldn't find which app has inputs.conf which enable reading audit logs and forward to _audit index.

May I know which app consists inputs to read and send data to _audit index in Splunk?

Re: Does Splunk Universal Forwarder forward audit events

gcusello — Fri, 11 Jan 2019 15:37:28 GMT

Hi ankithreddy777
they are in system/default and/or system/local.
Bye.
Giuseppe

Re: Does Splunk Universal Forwarder forward audit events

lakshman239 — Fri, 11 Jan 2019 15:38:02 GMT

You would see default/outputs.conf on the SplunkForwarder app with

[tcpout]
forwardedindex.x.whitelist= (_audit | _introspection | _telemetry)

This would forward all the _* logs to index layer.

Re: Does Splunk Universal Forwarder forward audit events

gcusello — Wed, 31 Jul 2019 13:01:08 GMT

Hi ankithreddy777
if you're satisfied by this answer, please accept and/or upvote it.

Bye, see next time.
Giuseppe