Documentation for journald_input

[opoplawski]

I see that there is a journald_input app in the splunk forwarder install, but I can't seem to find any information on how to use it.  I ran:

/opt/splunkforwarder/bin/splunk enable  app journald_input

But it doesn't appear to be ingesting any entries from the journal.

[richgalloway · Accepted solution]

The app is enabled, but is an input enabled (they're separate)?  Use btool to check

splunk btool inputs list --app=journald_input

or examine the inputs.conf files

less /opt/splunkforwarder/etc/apps/journald_input/default/inputs.conf /opt/splunkforwarder/etc/apps/journald_input/local/inputs.conf

[opoplawski]

Ah, thanks.  I guess /opt/splunkforwarder/etc/apps/journald_input/README/inputs.conf.spec is the reference then.  It also wasn't entirely clear to me that the "<name>" for the input appears to be arbitrary.

Unfortunately for the moment, it looks like this will not work on EL7 as it uses the --output-fields option to journalctl which is not present there.