I have a NEMS instance that collects data about the status of the host on our network.
On the NEMS side, I have the Universal forwarder installed and the Nagios Core add-on in the apps directory, and on the Splunk side, I have the app Splunk Add-on for Nagios Core as well as receiving configured.
The only way that we receive any data is to do a monitor of /var/log . If we monitor that directory we do get data but not all the Splunk data.
We can get that data if we monitor the Nagios log manually.
I thought that was a function of the Nagios core app, to add in getting useful data into Splunk-
can someone help me determine my error?