All Apps and Add-ons

Splunk for Nagios with main index

daeshuis
Engager

Hi Splunkbase,

I am very new to Splunk. The question I have is the following:

My Splunk and Nagios are on the same machine, both use syslog. Splunk to index (to the main index) and Nagios throws everything it's got in there. I have installed Splunk for Nagios but as hard as I try i don't get Splunk For Nagios to use the main index.

I have looked around on the forum and tried several thing. I created a nagios index, and also index the nagios.log. But this is not the place I would like to index and does not contain everything.

I have tried to also use the /var/log/messages again, but I am to new to know how to edit breaks or edit sources etc. How can I make Splunk For Nagios look in the main index?

If I missed something in the forum where such an answer has allready been given, then I apologize sincerely. Then I truly have missed it and then I do not want the answer given again. But then please point me toward the correct splunkbase question and I will go from there.

I am using Splunk 5.0.2 and Splunk For Nagios 2.0.1

Daniel

Tags (1)
0 Karma
1 Solution

lukeh
Contributor

Hi,

You could change all of the dashboards to use index=main instead of index=nagios 🙂

BTW, Splunk for Nagios 3.0.0 has been released so please upgrade first 🙂

All the best,

Luke 🙂

View solution in original post

lukeh
Contributor

Hi,

You could change all of the dashboards to use index=main instead of index=nagios 🙂

BTW, Splunk for Nagios 3.0.0 has been released so please upgrade first 🙂

All the best,

Luke 🙂

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!