I'm very new to splunk and trying to do a POC on my laptop. I installed windows version of splunk and installed the splunk. I'm trying to configure the forwader and receiver to search the event logs on laptop.
For receivers I configured it via splunk web
Manager >> Forwarding and receiving >> Configuring receiving and gave the port as 9997
Following files were modified
Copy paste mistake, my inputs.conf file has the following info.
[monitor://C:\\Windows\\System32\\winevt\\Logs\\*.*] _TCP_ROUTING = my_indexers
[tcpout] defaultGroup=my_indexers [tcpout:my_indexers] compressed=false server=localhost:9997
After above changes I restarted the splunkd and splunk web and tried the following in the search
index = my_indexers
which is returning nothing......
Did I miss any configurations? do I need to install any windows app for forwarders please advise, thank you very much.
The audit is an index that gets created automatically and it is used internally by splunk.
Try putting the the stanza in your $SPLUNKHOME/etc/system/local/inputs.conf:
index = main
disabled = false
This should bring in all data under Logs dir. Don't forget to do a restart of splunk.
Technically speaking, you dont need to forward local data to the localhost (like you're doing with outputs.conf) - your indexer instance can read/monitor files just fine 🙂
It seems like you're routing the data using the inputs.conf and then trying to search data on the wrong and probably non-existing index? It seems like myindexers is your tcpout group name.
Give this a try and comment let us know whether it works:
- remove "TCPROUTING = myindexers" from your inputs file
- put this instead: "index = main" or whatever index you want the data to go to.
thanks for responding....
This is what I did per you suggestions
index = main
and trying to search index = main and still fails.
To give the complete picture I installed indexer, forwarder and receiver on the same machine i.e. my laptop and trying to forward event logs to the receiver and index it and ready for search and I'm failing there.
but if I search like index="_audit" spluk is returning the results. I did not create that index.