Forwarding logs from AIX to Splunk on Windows?

[ajayk]

We have installed Splunk on Windows . We would like to forward log messages from AIX box to Splunk on Windows. However the forwarding is not working.

Looking at this - http://www.splunk.com/base/Documentation/latest/Deploy/Enableareceiver
I think, we have to install an app for AIX. Where can I find one ?

[mw]

You need to configure some inputs:

# inputs.conf
[monitor:///var/log]
disabled=0
sourcetype=syslog

You need to configure the Universal forwarder to send events to the Splunk server:

# outputs.conf
[tcpout]
defaultGroup = group1
indexAndForward = false

[tcpout:group1]
server = splunk_server:9997
useACK = true

[ajayk]

We are using second scarnario. We are testing with application logs .. to start with.

Universalforwarder has been installed on AIX boxes. On windows 2003 Server 32 bit, We have Splunk listening on port 9997. However, the Universalforwarder is not able to forward the logs.

[mw]

You can either configure your Splunk instance to listen on udp:514 for syslog traffic, and configure the AIX systems to send syslog events to it via their built-in syslog service, or you can configure Splunk to receive forwarded data and install a forwarder on each AIX system ( http://www.splunk.com/download/universalforwarder ) which you'll then instruct to monitor all files in /var/log, as well as configuring it to forward data via outputs.conf

For the first scenario, you'll need this:

Receive syslog: http://www.splunk.com/base/Documentation/latest/Data/Monitornetworkports

For the second scenario, you'll need these:

Universal Forwarder download: http://www.splunk.com/download/universalforwarder

Monitor files: http://www.splunk.com/base/Documentation/latest/Data/Monitorfilesanddirectories

Forwarding and Receiving: http://www.splunk.com/base/Documentation/4.2.1/Deploy/Setupforwardingandreceiving