All Apps and Add-ons

Linux AuditD - Missing inputs.conf?

nhertzberg
New Member

I was installing the Linux AuditD app and the TA on my Splunk instance and my forwarders installed on RHEL 7 systems when I noticed that there's no inputs.conf file in either the app or the TA. How are my indexers supposed to get and use any data from the systems without the forwarders sending the data over? Am I just supposed to make one myself?

I had a look at the video guide for version v2 (something like 6 years ago), and that one seems to have an inputs.conf file, unlike the current version v3.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

with quick look, this TA/app didn't contains any inputs at all. This is just for presenting auditd events on SH and also do needed filed extractions on SH/Indexer/HF. See https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration

To get events from clients you should use e.g. your own TA with inputs or use e.g. Splunk Add-on for Unix and Linux https://splunkbase.splunk.com/app/833 to collect those from UFs

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more!  Faster Time to Value Managing and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...