Getting Data In
Highlighted

How can I use a universal forwarder to send log files in specific directory to ArcSight?

Explorer

I am already sending *.debug syslog data to an ArcSight connector in rsyslog.conf. Now they want to monitor some application logs in a specific directory. I have installed the universal forwarder, but not really sure how to setup inputs.conf and outputs.conf to send the log files. Any help is greatly appreciated.

0 Karma
Highlighted

Re: How can I use a universal forwarder to send log files in specific directory to ArcSight?

Splunk Employee
Splunk Employee

Hey B,

You can use monitor input's in your inputs.conf file, or use the CLI. See example 5 here.

Regarding outputs.conf, you want to add something like this into $SPLUNK_HOME/system/local/outputs.conf:

[tcpout]
defaultGroup=my_indexers

[tcpout:my_indexers]
server=mysplunk_indexer1:9997, mysplunk_indexer2:9997
autoLB = true

More info here.

Remember when editing .conf file, you need to restart the forwarder afterwards.

i.e. #splunk restart

Hope this helps,
Kyle

0 Karma