topic Re: Reading Drupal syslog with Splunk in Getting Data In

Reading Drupal syslog with Splunk

88mac — Wed, 14 Sep 2016 11:41:17 GMT

Hi, I have set the syslog Drupal and I followed this guide: http://www.asmallwebfirm.net/blogs/2013/04/achieving-drupal-log-bliss-splunk
Without the syslog drupal configuration, now I want to read log files (which I set in the syslog var / log / drupal.log folder) with Splunk.
Can you help to set Splunk to read the log drupal?

Re: Reading Drupal syslog with Splunk

dmaislin_splunk — Wed, 14 Sep 2016 12:58:46 GMT

I have no idea what your Splunk experience is, but:

Install a Splunk Forwarder on the Drupal server to forward data from the forwarder to the Splunk Server. This means there is a properly configured outputs.conf that knows where to send the data. Also ensure your Splunk Server has receiving enabled on port 9997 by default.

On the forwarder you also need an inputs.conf:

[monitor:///var/log/drupal.log]
sourcetype=drupal

Once you restart the forwarder it should start sending logs to your Splunk server. I hope this helps.

Re: Reading Drupal syslog with Splunk

88mac — Wed, 14 Sep 2016 14:33:25 GMT

I use on Drupal, the file rsyslog.conf.
At the end of this file, I put in this code:
local0.* /var/log/drupal.log
local0.* @@ip:ports

Splunk now it enables the port, but nothing happens. Splunk does not see the Drupal data

Re: Reading Drupal syslog with Splunk

dmaislin_splunk — Wed, 14 Sep 2016 15:14:33 GMT

If you are sending data to Splunk on UDP or TCP, in Splunk on the indexers did you enable data inputs/udp or data inputs/tcp on port 514?

Re: Reading Drupal syslog with Splunk

88mac — Wed, 14 Sep 2016 15:23:02 GMT

Then I go on Splunk on "Forwarding and receiving", "Receive data" and imposed on port 514? Correct?

Re: Reading Drupal syslog with Splunk

dmaislin_splunk — Wed, 14 Sep 2016 15:48:50 GMT

No. Settings/Forwarding and Receiving is when you use forwarders on port 9997 (default).

Settings/Data Inputs/UDP or TCP is where you add 514 with rsyslog.