Reading Drupal syslog with Splunk

[88mac]

Hi, I have set the syslog Drupal and I followed this guide: http://www.asmallwebfirm.net/blogs/2013/04/achieving-drupal-log-bliss-splunk
Without the syslog drupal configuration, now I want to read log files (which I set in the syslog var / log / drupal.log folder) with Splunk.
Can you help to set Splunk to read the log drupal?

[dmaislin_splunk · Accepted solution]

I have no idea what your Splunk experience is, but:

Install a Splunk Forwarder on the Drupal server to forward data from the forwarder to the Splunk Server. This means there is a properly configured outputs.conf that knows where to send the data. Also ensure your Splunk Server has receiving enabled on port 9997 by default.

On the forwarder you also need an inputs.conf:

[monitor:///var/log/drupal.log]
sourcetype=drupal

Once you restart the forwarder it should start sending logs to your Splunk server. I hope this helps.

[88mac]

I use on Drupal, the file rsyslog.conf.
At the end of this file, I put in this code:
local0.* /var/log/drupal.log
local0.* @@ip:ports

Splunk now it enables the port, but nothing happens. Splunk does not see the Drupal data

[dmaislin_splunk]

If you are sending data to Splunk on UDP or TCP, in Splunk on the indexers did you enable data inputs/udp or data inputs/tcp on port 514?

[88mac]

Then I go on Splunk on "Forwarding and receiving", "Receive data" and imposed on port 514? Correct?

[dmaislin_splunk]

No. Settings/Forwarding and Receiving is when you use forwarders on port 9997 (default).

Settings/Data Inputs/UDP or TCP is where you add 514 with rsyslog.