Getting Data In

DATA INPUTS - monitor a file on a system that is not a Splunk LWF

Voltaire
Communicator

Is it possible to monitor a log file from a Linux system that is not configured as a LWF? I configured the Data Inputs via Splunkweb and the inputs.conf file

[monitor:///sunusr/slapd-eds1/logs/access]
host = eds1.host.DNS
disabled = false
index = eds

[monitor:///sunusr/slapd-eds1/logs/errors]
host = eds1..host.DNS
disabled = false
index = eds

[monitor://sunusr/slapd-eds1/logs/audit]
host = eds1..host.DNS
disabled = false
index = eds

The Splunkweb GUI validates that 1 file is available. Those files are also displayed in the Splunk list monitor, Although I am still not getting any data? When I search on that index there are no events. Nor has the index grown in size at all. Do I have to configure it as a LWF or what is the best way to monitor these files?

Please advise. Thank you

V

Tags (1)
0 Karma

Lamar
Splunk Employee
Splunk Employee

I'm curious, is the /sunusr mounted directory from your Linux machine available on your indexer?

If not, I would suggest getting that mounted -- once mounted you should be right as rain.

If so, then I would suggest first testing your input on a directory that is local to ensure that your eds index is setup appropriately and you can in fact index the data you're trying to index.

Syslog is certainly an option but not necessary in this instance.

EDIT: Additionally, there are a couple of typos in your configuration.

[monitor://sunusr/slapd-eds1/logs/audit]

to

[monitor:///sunusr/slapd-eds1/logs/audit]

And beware the additional "." you have in your host entries.

0 Karma

stephanbuys
Path Finder

Syslog is a good option. You can configure a UDP or TCP input for that purpose using the Splunk Manager.

You should also be able to use NFS to mount the log files on the production server to your local filesystem, then just load Splunk on the server and point it to the correct folder.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Any type of Splunk installation should be able to monitor files. Lightweight Forwarding simply means that the data isn't indexed locally but rather shipped to another indexer.

I assume that the "eds" index is properly configured on this system. Are there any warnings about these paths in splunkd.log?

0 Karma

Voltaire
Communicator

The Index configuration is correct. I have not installed Splunk on the eds1 system.I am trying to obtain the log files from the main indexer. EDS1 is a production system. Wonder if it may work by configuring the system to send the files over via a syslog function?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...