Getting Data In

How do I send journald logs to my Splunk indexer?

ctjd81
New Member

I would like to separate these logs into units (ie - etcd.service, kube-apiserver.service, kube-controller-manager.service, etc)
I'd then like to send those different logs to Splunk.
Do I have to force these logs to a file first, then move them?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Since splunk can't read the default binary format of journal , you should write to a text file and then forward (don't remember but read it somewhere)

There is a blog which talks about this in detail for different flavors, might be useful for you .

http://blogs.splunk.com/2015/04/30/integrating-splunk-with-docker-coreos-and-journald/

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Since splunk can't read the default binary format of journal , you should write to a text file and then forward (don't remember but read it somewhere)

There is a blog which talks about this in detail for different flavors, might be useful for you .

http://blogs.splunk.com/2015/04/30/integrating-splunk-with-docker-coreos-and-journald/

View solution in original post

ctjd81
New Member

This got me a long way to the answer, thanks!!!

0 Karma

alastor
Path Finder

This is a terrible answer. Splunk should put this into the TA for NIX. expecting each customer to figure out some crap method of this is BS.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!