Linux AuditD - Missing inputs.conf?

[nhertzberg]

I was installing the Linux AuditD app and the TA on my Splunk instance and my forwarders installed on RHEL 7 systems when I noticed that there's no inputs.conf file in either the app or the TA. How are my indexers supposed to get and use any data from the systems without the forwarders sending the data over? Am I just supposed to make one myself?

I had a look at the video guide for version v2 (something like 6 years ago), and that one seems to have an inputs.conf file, unlike the current version v3.

[isoutamo]

Hi

with quick look, this TA/app didn't contains any inputs at all. This is just for presenting auditd events on SH and also do needed filed extractions on SH/Indexer/HF. See https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration

To get events from clients you should use e.g. your own TA with inputs or use e.g. Splunk Add-on for Unix and Linux https://splunkbase.splunk.com/app/833 to collect those from UFs

r. Ismo