Getting Data In

Ingesting logs from rsyslog

awslabspl
Observer

Im furious............

2 hosts ( physical ) :: both Ubuntu Server. Read about Splunk and how dibi **bleep**s GHA ( soim)

 

Host #1: Installed Splunk as in docs, !!!!!!!!!!!!!

Host #2: created FREE Splunk cloud,

Configured everything as in docs.

 

No **bleep**ing logs.

 

HELP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @awslabspl,

let me understand better because you shared few informations:

  • you have a physical host that's receiving syslogs with rsyslog,
  • rsyslog receives sysloigs and writes them in files,
  • you want to read thes logs and send them to. Splunk;

is it correct?

If yes, some questions:

  • to which Splunk do you want to send logs: Splunk Cloud or on premise?
  • what do you mean saying: "Host #2: created FREE Splunk cloud"?
  • the rsyslog server is one of host 1 or host 2 or it's in another host?
  • what's your architecture?

In few words:

  • you can use one of the servers are syslog server and the second as Splunk All-in-one,
  • or you can use an host both as rsyslog server and Splunk All-in-one.

At firest obviously, you have to check if the rsyslog server is writing syslogs in files.

Then if you have all in the same host (rsyslog and Splunk) you have to configure inputs on Splunk.

If instead you are using two servers, you have to install another Splunk as Heavy Forwarder or a Universal Forwarder on the rsyslog server that sends logs to the Splunk.

In both cases see at https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Getstartedwithgettingdatain how to ingest data.

Ciao.

Giuseppe

0 Karma

awslabspl
Observer

@gcusello thanks for the answer. I will not go into details as of my arch.

On the other hand Im 99% sure I will look for other log-management solution.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @awslabspl,

I don't know why you's so sure to use another solution when the most customers are using Splunk!

Anyway, tell me if you want to continue the analysis of your Use Case.

Ciao and good luck with another solution.

Giuseppe

0 Karma

awslabspl
Observer

No answer??????????????????????????

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...