topic Re: splunk inputs.conf in Getting Data In

splunk inputs.conf

sanaa — Mon, 22 Aug 2016 08:58:44 GMT

Hi ,

I am pretty much new to splunk and i have splunk forwarder configured in one of my linux server .

Now i want to send the audit.log of that server to cplunk using splunk forwarder.

Which all files i need to modify?

splunkforwarder-5.0.2-149561 is the version

Re: splunk inputs.conf

Raghav2384 — Mon, 22 Aug 2016 17:06:26 GMT

Hello @sanaa,

I would highly recommend you to read

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Getstartedwithgettingdatain

and the following configuration files

Inputs.conf: https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Inputsconf &

Outputs.conf: https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Outputsconf

Step1: in inputs.conf under /opt/splunk/etc/system/local/

add a monitor stanza

[monitor:///path to the audit log file]
index = name of the index where you want it to send
sourcetype = audit

In outputs.conf

[tcpout]
defaultGroup = Name of your Indexer layer

[tcpout:Name of your Indexer layer]
autoLB = true
autoLBFrequency = 60 (seconds to switch to new indexer)
server = list your indexers and receiving port (eg: 1.2.3.4:9997,5.6.7.8:9997 etc)

Finally, restart splunkd service. I would highly recommend you to read the docs first.

Hope this helps!

Thanks,
Raghav

Re: splunk inputs.conf

sanaa — Tue, 23 Aug 2016 09:09:42 GMT

Hi ,

i configured the inputs.conf and outputs.conf as described . But still cant see the events in dahsboard .

Can you please tell me is there a way i can trouble shoot or is there somewhere i have to open ports for netwrok communication as it runs on 9997

Re: splunk inputs.conf

Raghav2384 — Tue, 23 Aug 2016 21:12:53 GMT

Correct, first thing you need is connectivity between source and destination. From source, do a quick telnet to destination on 9997
Telnet destination-ip 9997 if it's connected, check splunkd.log on both source and destination.

Location $SPLUNK_HOME/var/log/splunk/splunkd.log

Look for any errors in these logs.

Thanks,
Raghav