Getting Data In

input.conf first timer

daniel333
Builder

All,

I just finished day 1 of the administration of Splunk class. Gotta admit to being lost.So I fired up a lab, 3 VMs. splunk01, host01, deploy01 and DC01 (for DNS).

Installed Splunk on Splunk01 and it worked. Enabled the listening on 9997. Installed the forwarders on host01. I can see the host check in when I do a search with index=_internal *splunkforwarder* as we did in the class.

But I made my own little "app". I created a folder under /opt/splunkforwarder/etc/myappname and folder under there called /local

My inputs.conf which I placed in /local reads as follows

[monitor:///var/log/messages]
disabled = 0
index=main

I restarted the forwarder, waited. Nothing ever came through. Any ideas to what I should be checking now?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

You have ommitted the apps directory from the path :

/opt/splunkforwarder/etc/apps/myappname/local/inputs.conf

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...