Getting Data In

Forwarding profiles - how to

hokie1999
Explorer

Is there any way to set up profiles for commonly forwarded logs? I see:

http://docs.splunk.com/Documentation/WAS/latest/User/logdata

details logs. Is there any way I can set up a profile from the indexer to grab all the SystemErr.log, SystemOut.logs from app servers?

BTW, I'm running Splunk 5.0.2 on Red Hat 6.3. I have 2 indexers that are replicating, two search heads, and one master. Perhaps 80 devices are forwarding to the indexers.

Tags (1)
0 Karma

hokie1999
Explorer

Thanks for the answer. What I wound up doing was adding lines to my expect script like so:

    expect "]#" { send "find /opt/IBM -name 'SystemErr.log' > $tempfile\r" }
    expect "]#" { send "find /opt/IBM -name 'SystemOut.log' >> $tempfile\r" }
    expect "]#" { send "find /opt/IBM -name 'trace.log' >> $tempfile\r" }
    expect "]#" { send "sed -i 's/^/\[monitor\:\\/\\//' $tempfile\r" }
    expect "]#" { send "sed -i 's/$/\]/' $tempfile\r" }
    expect "]#" { send "cat $tempfile >> $inputfile\r" }
    expect "]#" { send "/opt/splunkforwarder/bin/splunk restart\r" }
    expect "]#" { send "ps -ef | grep splunk\r" }

where $inputfile is /opt/splunkforwarder/etc/system/local/inputs.conf

This produces output like this in the inputs.conf file:

[monitor:///var/log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/BUSILABDE.Messaging.ddcwesbn2-WESBIlabNode02.0/SystemErr.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/nodeagent/SystemErr.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/BUSILABDE.WebApp.ddcwesbn2-WESBIlabNode02.0/SystemErr.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/WESBIlabNode02_proxy/SystemErr.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/BUSILABDE.AppTarget.ddcwesbn2-WESBIlabNode02.0/SystemErr.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/BUSILABDE.Support.ddcwesbn2-WESBIlabNode02.0/SystemErr.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/BUSILABDE.Messaging.ddcwesbn2-WESBIlabNode02.0/SystemOut.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/nodeagent/SystemOut.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/BUSILABDE.WebApp.ddcwesbn2-WESBIlabNode02.0/SystemOut.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/WESBIlabNode02_proxy/SystemOut.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/BUSILABDE.AppTarget.ddcwesbn2-WESBIlabNode02.0/SystemOut.log]
[monitor:///opt/IBM/WebSphere/WesbServer/profiles/WESBIlabNode02/logs/BUSILABDE.Support.ddcwesbn2-WESBIlabNode02.0/SystemOut.log]

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You might want to set the monitor to /opt/*.log or a similar expression matching all your log files, and then whitelisting (or blacklisting) your way towards the correct set of files.

0 Karma

hokie1999
Explorer

Follow up question. Let's say I want to monitor three files, /opt/a.log, /opt/b.log, /opt/c.log

What would the [monitor://xxxx] statement in inputs.conf look like? Could I do this:

[monitor:///opt/a.log,/opt/b.log,/opt/c.log]

or does it have to be

[monitor:///opt/a.log]
[moniotr:///opt/b.log]
[monitor:///opt/c.log]

Thanks.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...