All Apps and Add-ons

How to Ingest Splunk Server Data into Index?

hart918
Explorer

I am trying to get the Splunk server data, such as system logs and audit logs, into the same index as my other Linux servers using the Splunk Linux App.  How do I get this data ingested into my Linux Index?  So far the forums and discussion groups only refer to the Splunk software data when I'm trying to get the server data.  I have the app installed on each of my Splunk Servers in the /app folder.

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The inputs.conf file is where the destination index name is specified so that is where you would tell Splunk to put the data in the "linux" index.

Verify Splunk has permission to read the monitored files.  That's the most common reason for data not showing up in Splunk.  There should be messages in _internal to that effect.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @hart918,

are you speaking of Splunk or Linux system and audit logs?

if Splunk, as @richgalloway said, they automatically are in _internal and _audit indexes.

If you're speaking of Linux system and audit logs, they usually are in the "os" index, but it must be configured, by GUI or by conf files.

Ciao.

Giuseppe

richgalloway
SplunkTrust
SplunkTrust

When you say "Splunk server data" are you referring to Splunk's own logs (index=_internal) or the server on which Splunk is running (/var/log)?

Which inputs have you enabled in the Splunk Linux App?

---
If this reply helps you, Karma would be appreciated.

hart918
Explorer

I'm referring to the server data, /var/log/*.  Within the app's input.conf I have everything enabled, but when I do a search,  I don't see any log data for the server.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The inputs.conf file is where the destination index name is specified so that is where you would tell Splunk to put the data in the "linux" index.

Verify Splunk has permission to read the monitored files.  That's the most common reason for data not showing up in Splunk.  There should be messages in _internal to that effect.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...