All Apps and Add-ons

I need assistance on inputs.conf syntax for Linux log ingestion

Jarohnimo
Builder

Hello All,

I'm new to linux. I have experience using the deployment server and creating my own apps in Splunk to receive information sent to the index of my choice. I have a new requirement to fetch some linux data where I'm not too familiar and would like some assistance on the basic syntax for the deployment apps. Can someone please provide syntax examples for the deployment apps for the logs specified below so I can familiarize myself.

var/log/messages

var/log/secure

var/log/boot.log

var/log/yum.log

var/log/audit/(all files)

var/log/sa/(all files)

var/log/firewalld

I have the tomcat app however that setup process seems to be different and doesn't support deployment apps.

Please let me know if there are other apps I can use to make this process easier or if creating my own apps are best. Thank you!

0 Karma

sapanda
Path Finder

Hello @Jarohnimo ,

Below are a few links which will help you understand how to setup the inputs.conf file for you app to get data for Linux log messages into your splunk enterprise.

https://docs.splunk.com/Documentation/Splunk/7.2.3/Updating/Exampleaddaninputtoforwarders

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&utm_medium=i...

https://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/DeploytheSplunkAdd-onforUnixandLinuxinadi...

Hope this helps.

Thanks,
Sapan

0 Karma

FrankVl
Ultra Champion

Have a look at Splunk TA-nix: https://splunkbase.splunk.com/app/833/

This also includes a sample inputs.conf file if I recall correctly. That should give some inspiration (although likely needs tuning for the specific files as they exist on your linux box(es). That should also point you at what sourcetype to use.

But (assuming you have a splunk forwarder installed on the linux box(es)) basically you just need to create some file monitor inputs, see inputs.conf reference documentation for syntax.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...