Installation

How to start indexing a new syslog host?

dritjon
Path Finder

Bear with me as this is the first time im doing this.

I configured a vmware host to send its events via syslog to splunk. It is working. Raw logs are stored in /opt/syslog/192.168.x.x in four different types (local, daemon logs etc)

Now, how do I index these logs? How do I create a new index=vmware which will start index raw logs and I can start searching?

Googled a bit but I cant find a step-by-step tutorial

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dritjon,

let me understand: you configured a syslog-ng or anotehr kind of syslog server that writes the received logs in files of the above folder, is it correct?

The second question is: syslog server in on the same server where Splunk is installed or in a different one?

If in the same server you have to:

  • by GUI create a new index (better) or use an existing one (e.g. main) [Settings -- Indexes -- new Index],
  • by GUI create a new input [Settings -- Data inputs -- Files & Directories -- New Local File & Directory]
  • use your logs in searches

if in different servers, you have to:

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...