Getting Data In

Forwarding logs from AIX to Splunk on Windows?

ajayk
New Member

We have installed Splunk on Windows . We would like to forward log messages from AIX box to Splunk on Windows. However the forwarding is not working.

Looking at this - http://www.splunk.com/base/Documentation/latest/Deploy/Enableareceiver
I think, we have to install an app for AIX. Where can I find one ?

Tags (1)
0 Karma

mw
Splunk Employee
Splunk Employee

You need to configure some inputs:

# inputs.conf
[monitor:///var/log]
disabled=0
sourcetype=syslog

You need to configure the Universal forwarder to send events to the Splunk server:

# outputs.conf
[tcpout]
defaultGroup = group1
indexAndForward = false

[tcpout:group1]
server = splunk_server:9997
useACK = true
0 Karma

ajayk
New Member

We are using second scarnario. We are testing with application logs .. to start with.

Universalforwarder has been installed on AIX boxes. On windows 2003 Server 32 bit, We have Splunk listening on port 9997. However, the Universalforwarder is not able to forward the logs.

0 Karma

mw
Splunk Employee
Splunk Employee

You can either configure your Splunk instance to listen on udp:514 for syslog traffic, and configure the AIX systems to send syslog events to it via their built-in syslog service, or you can configure Splunk to receive forwarded data and install a forwarder on each AIX system ( http://www.splunk.com/download/universalforwarder ) which you'll then instruct to monitor all files in /var/log, as well as configuring it to forward data via outputs.conf

For the first scenario, you'll need this:

Receive syslog: http://www.splunk.com/base/Documentation/latest/Data/Monitornetworkports

For the second scenario, you'll need these:

Universal Forwarder download: http://www.splunk.com/download/universalforwarder

Monitor files: http://www.splunk.com/base/Documentation/latest/Data/Monitorfilesanddirectories

Forwarding and Receiving: http://www.splunk.com/base/Documentation/4.2.1/Deploy/Setupforwardingandreceiving

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...