topic Re: How to collect Slack logs in Knowledge Management

How to collect Slack logs

euroa — Mon, 25 Jul 2016 20:23:45 GMT

Hi,
I created an app with an inputs.conf file to collect syslog data (udp 514) from a particular host and send it to a sourcetype and index. I see the data coming in when I run a Wireshark but I dont see the data when I run a search query on the index I specified. Any clues?

Re: How to collect Slack logs

esix_splunk — Mon, 25 Jul 2016 23:46:40 GMT

Are you collecting the syslog on the Splunk indexer, or forwarding it from the box with a syslog input to another Splunk box? Please include you inputs and outputs conf files.

Re: How to collect Slack logs

euroa — Tue, 29 Sep 2020 10:18:42 GMT

I am collecting syslogs on a heavy forwarder and then forwarding that off to Splunk Cloud indexers.

Inputs.conf
[udp://ip address here:514]
connection_host = dns
sourcetype = slack
index = slack
disabled = false

outputs.conf (is contained on a different app that outputs all )

[tcpout]
defaultGroup = splunkcloud
forwardedindex.2.whitelist = (_audit|_introspection|_internal)

[tcpout:splunkcloud]
server = splunkcloud addresses here :9997
compressed = false