Hi there --
I completed installing the latest version of Splunk on two systems where the first is the server, and the second is the client. The former has been configured to receive data on port 9997 while the latter has been set up to forward data on the same port. Both systems use Linux operating systems.
What I am trying to set up between the two is a file integrity monitoring of the client from the server. I had several questions concerning this:
1 - If you are monitoring anything at all on the forwarder then you should (theoretically) see it immediately as you log on to your indexer on the search dashboard (this is assuming you are sending it to a visible index) . If you know you have data being monitored on the forwarder then try searching on the receiver for host= (make sure you use the forwarder's name)
2(+3) - Read the documentation on fschange and see if this is what you had in mind:
Possibly, you are going to monitor the data on the forwarder and send it to the receiver. Let me know if more help is needed or if i have misunderstood your question (or if what i suggested doesnt work for ya )
Hi there --
I believe the connection between the server and client has been established. Listed below is an excerpt:
localhost - - [20/Jul/2010:10:17:20 -0400] "POST / HTTP/1.1" 200 129 CUPS-Get-Classes client-error-not-found
* host=Hadron Options| * sourcetype=cups_access Options| * source=/var/log/cups/access_log
The only thing that I am confused about is the mention of the localhost. Does that mean the readout is actually from the Splunk server, or is the information actually coming from the Hadron client system?