How to Ingest Splunk Server Data into Index?

[hart918]

I am trying to get the Splunk server data, such as system logs and audit logs, into the same index as my other Linux servers using the Splunk Linux App.  How do I get this data ingested into my Linux Index?  So far the forums and discussion groups only refer to the Splunk software data when I'm trying to get the server data.  I have the app installed on each of my Splunk Servers in the /app folder.

[gcusello]

Hi @hart918,

are you speaking of Splunk or Linux system and audit logs?

if Splunk, as @richgalloway said, they automatically are in _internal and _audit indexes.

If you're speaking of Linux system and audit logs, they usually are in the "os" index, but it must be configured, by GUI or by conf files.

Ciao.

Giuseppe

[richgalloway]

When you say "Splunk server data" are you referring to Splunk's own logs (index=_internal) or the server on which Splunk is running (/var/log)?

Which inputs have you enabled in the Splunk Linux App?

[hart918]

I'm referring to the server data, /var/log/*.  Within the app's input.conf I have everything enabled, but when I do a search,  I don't see any log data for the server.

[richgalloway · Accepted solution]

The inputs.conf file is where the destination index name is specified so that is where you would tell Splunk to put the data in the "linux" index.

Verify Splunk has permission to read the monitored files.  That's the most common reason for data not showing up in Splunk.  There should be messages in _internal to that effect.