Getting Data In

Universal Forwarder for OSX installed - how is it configured ?

eyeLikeCarrots
New Member

Hello All,

I have the OSX Universal Forwarder installed on a 10.5 machine and Splunk installed on a server successfully receiving events from two Windows machines.

How do I configure the OSX Forwarder to:

  • Nominate the log files I want monitored.
  • Set the IP address of the server that the Forwarder will send event data too.

I cannot find this specific information in the documentation.

Cheers

Tags (1)
0 Karma

lguinn2
Legend

You need to create the following files:

inputs.conf - to identify the files to be monitored

See http://docs.splunk.com/Documentation/Splunk/latest/Data/Editinputs.conf for help. You may also need props.conf, but it depends on your inputs. Here is an example that monitors a single syslog log file:

[monitor:///logs/mylogfile.log]
sourcetype=syslog
host=yourOSXhostname

outputs.conf - to tell Splunk where to forward the data. Example:

[tcpout:my_indexer]
server=10.10.10.1:9997

Note that you have to supply the server ip (or dns name) and the port number where Splunk is listening for forwarded data. See http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Configureforwarderswithoutputs.confd for more info and options.

Put the files in "/Applications/splunkforwarder/etc/system/local" or your equivalent.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...