How do I ingest Linux logs on my indexers?

[jrabidoux]

I am running a distributed Splunk environment. I have three indexers, an index master, a search head, and a universal forwarder deployment server. The universal forwarders load balance between the three indexers. I would like to ingest the logs like /var/log/secure/ and /var/log/messages that are on the indexers themselves so I can monitor logins and whatnot on those servers. Can I simply add the log files in question to $SPLUNK_HOME/etc/system/local/inputs.conf, on each indexer or is there a better way to attack indexing Linux logs on the indexers in the cluster?

[somesoni2 · Accepted solution]

You should configure the monitoring configuration, inputs.conf, to a app and deploy that app through the cluster master. See this for more information on distribution of app to indexer cluster peers from cluster master:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Updatepeerconfigurations

[jrabidoux]

Perfect! Exactly what I was looking for. Worked like a charm!

Many Thanks!