Getting Data In

How set up forwarding on linux-to-linux

hokie1999
Explorer

No firewall between forwarder A and indexer B. Both are Red Hat 2.6...

/opt/splunkforwarder/etc/system/local/outputs.conf on A (which has universal forwarder):

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 152.190.138.158:9997

[tcpout-server://152.190.138.158:9997] <<< This is my indexer

On the indexer I have "manager -> Forwarding and receiving -> receive data" set to 9997

Are "/var/logs" natively set to be sent to the indexer? Or does this have to be configured?

Tags (1)
0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

hokie1999,

One thing to note here. You edited your default inputs.conf. This is generally considered bad practice. If you were to update your universal forwarder to a newer version, the update process would revert your change back to, as the name implies, the default.

Right at the top of the default/inputs.conf (as well as other default/*.conf files) there is a warning stating not to edit the file.

You need to make this change in the local inputs.conf. In /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/, there should be a local directory. In it, there may or may not be a inputs.conf file. If there is, great, make your changes there. If there isn't, just copy the inputs.conf from the default directory into the local directory. Then make your changes to the inputs.conf in the local directory.

hokie1999
Explorer

The answer to this question, thanks to Ed Elisio, is to configure

/opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/inputs.conf

on the forwarding device to be something like this if you're interested in /var/log stuff:

[splunktcp]
route=has_key:tautology:parsingQueue;absent_key:tautology:parsingQueue

[monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log]
_TCP_ROUTING = *
index = _internal

[monitor:///var/log] <<<<<<<< added this

Restart the universal forwarder, too.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...