Getting Data In

how to setup splunk to analyse logs produced on a remote server?

mmikrouli
New Member

Hi! I am a newbie to Splunk. I have an application on a linux server that produces logs in log4j format. I want to receive these logs on a windows machine and analyse them (count errors and successes).
I have already installed Splunk Web on Windows machine and configured forwarding and receiving to receive data on port 9997 (as explained in http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver). I have also installed splunk forwarder on the linux server and configured inputs.conf as follows:
[tcp://9997]
connection_host=dns
sourcetype=log4j

and my log4j.xml, as follows:






But it does not work. Do I miss something? Can this be implemented?

Alternatively, how can I receive from the windows machine the log files generated by my log4j app and are stored in a specific path of the linux machine?

Thank you in advance,

-Mari

0 Karma
1 Solution

MickSheppard
Path Finder

You don't want to have your application connecting to port 9997 on the Windows machine. Instead you need to have the Splunk Forwarder on the Linux machine configured to forward log files from the Linux machine to the Windows machine.

To do this you'll need the following:

  • Configure your log4j.xml to append to a local file (I don't know how to do this bit).
  • Configure the Linux server to pick up the file by putting the following in inputs.conf

    [monitor:///path to log file] followTail = 0 disabled = false sourcetype = log4j

You can wildcard any date reference in the log file name if the file changes name dependent on the day.

  • Configure the Linux server to forward to the Windows server by putting similar to below in outputs.conf.

    [tcpout] defaultGroup=MyIndexers

    [tcpout:MyIndexers] server=WindowsServerIP:9997

If you restart Splunk on the Linux system this should forward the contents of the file monitored to your Splunk indexer. You can repeat the monitor stanza for other log files.

View solution in original post

MickSheppard
Path Finder

You don't want to have your application connecting to port 9997 on the Windows machine. Instead you need to have the Splunk Forwarder on the Linux machine configured to forward log files from the Linux machine to the Windows machine.

To do this you'll need the following:

  • Configure your log4j.xml to append to a local file (I don't know how to do this bit).
  • Configure the Linux server to pick up the file by putting the following in inputs.conf

    [monitor:///path to log file] followTail = 0 disabled = false sourcetype = log4j

You can wildcard any date reference in the log file name if the file changes name dependent on the day.

  • Configure the Linux server to forward to the Windows server by putting similar to below in outputs.conf.

    [tcpout] defaultGroup=MyIndexers

    [tcpout:MyIndexers] server=WindowsServerIP:9997

If you restart Splunk on the Linux system this should forward the contents of the file monitored to your Splunk indexer. You can repeat the monitor stanza for other log files.

mmikrouli
New Member

That was great help! Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...