Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- changes to config files
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi..
I was used to using splunk as a single instance in my laptop. I am new to forwarders and indexes. I have log data in the form of csv files available(with headers) . Assuming data is in /abc/data_files and splunk forwarder files are in /abc/splunkforwarder/etc/system/local.
In the local I only find these files
deploymentclient.conf, inputs.conf, outputs.conf, README, server.conf.
When I opened inputs.conf and outputs.conf I found them to be empty.
- How do I make the forwarder to pick the files from the location and start loading the data.
- How do I create a new index so that I can handle the data better.
- Why is there no props.conf file? Dont I need it? Why are the other files empty?
I do not know if I am even in the right direction in wanting to make changes in the forwarder. I am really lost. Please consider me to be a beginner. Please let me step by step or point me to a document to figure out how to do this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These should help you get started
Distributed Splunk Architecture: http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Distributedoverview
Indexer configuration
Index Creation: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setupmultipleindexes
Props entries/sourcetype definition: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Createsourcetypes
Forwarder configuration
Outputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Configureforwarderswithoutputs.confd
Inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Editinputs.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These should help you get started
Distributed Splunk Architecture: http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Distributedoverview
Indexer configuration
Index Creation: http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setupmultipleindexes
Props entries/sourcetype definition: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Createsourcetypes
Forwarder configuration
Outputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Configureforwarderswithoutputs.confd
Inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Editinputs.conf
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Persistent Queue at TcpOut — One of Splunk's Most Practical Features
Build resilience for the agentic era: Join us at Splunk Go San Jose
Manage Edge Processor pipelines end to end with APIs
