how to setup splunk to analyse logs produced on a remote server?

[mmikrouli]

Hi! I am a newbie to Splunk. I have an application on a linux server that produces logs in log4j format. I want to receive these logs on a windows machine and analyse them (count errors and successes).
I have already installed Splunk Web on Windows machine and configured forwarding and receiving to receive data on port 9997 (as explained in http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Enableareceiver). I have also installed splunk forwarder on the linux server and configured inputs.conf as follows:
[tcp://9997]
connection_host=dns
sourcetype=log4j

and my log4j.xml, as follows:

But it does not work. Do I miss something? Can this be implemented?

Alternatively, how can I receive from the windows machine the log files generated by my log4j app and are stored in a specific path of the linux machine?

Thank you in advance,

-Mari

[MickSheppard · Accepted solution]

You don't want to have your application connecting to port 9997 on the Windows machine. Instead you need to have the Splunk Forwarder on the Linux machine configured to forward log files from the Linux machine to the Windows machine.

To do this you'll need the following:

• Configure your log4j.xml to append to a local file (I don't know how to do this bit).

• Configure the Linux server to pick up the file by putting the following in inputs.conf

  [monitor:///path to log file] followTail = 0 disabled = false sourcetype = log4j

You can wildcard any date reference in the log file name if the file changes name dependent on the day.

• Configure the Linux server to forward to the Windows server by putting similar to below in outputs.conf.

  [tcpout] defaultGroup=MyIndexers

  [tcpout:MyIndexers] server=WindowsServerIP:9997

If you restart Splunk on the Linux system this should forward the contents of the file monitored to your Splunk indexer. You can repeat the monitor stanza for other log files.

[mmikrouli]

That was great help! Thank you very much!