Splunk App for Unix and Linux: Why am I only able to see localhost activity?

[rregeA]

Hello,

I have installed and configured the Splunk App for Unix and Linix and the Splunk Add-on for Unix and Linux.

At the moment I can see on the dashboard only logs from the Spunk host itself. All my other nix servers logs are indexed in OS index.
Configured all the source types correctly, but i see only the Splunk localhost logs on those source types.

[TStrauch · Accepted solution]

Ok thats the reason why.

you defined the parameter sourcetype with values that are not known by the splunk app for *nix.

The searches are based on sourcetypes.

Take the inputs.conf provided with the Splunk_TA_nix and configure it on your ufs.

After this you have the correct sourcetypes defined the Splunk App for *nix will show results.

kind regards

[TStrauch]

On which way the other nix logs get into your splunk environment?

[rregeA]

We use universal forwarders to send logs

[TStrauch]

please give me an example of the input.conf stanza for your inputs on the uf´s

[rregeA]

[monitor:///var/log/auth.log]
index = os
sourcetype = Unix:Authorization

[monitor:///var/log/secure]
index = os
sourcetype = Unix:Authorization

[monitor:///var/log/alternatives.log]
index = os
sourcetype = Unix:Alternatives

[monitor:///var/log/dpkg.log]
index = os
sourcetype = Unix:DPKG

[monitor:///var/log/boot.log]
index = os
sourcetype = Unix:Boot

[monitor:///var/log/daemon.log]
index = os
sourcetype = Unix:Daemon

[monitor:///var/log/apache2/access.log]
index = os
sourcetype = Unix:ApacheAccess

Here is a sample of some inputs