Knowledge Management
Highlighted

How to collect Slack logs

Engager

Hi,
I created an app with an inputs.conf file to collect syslog data (udp 514) from a particular host and send it to a sourcetype and index. I see the data coming in when I run a Wireshark but I dont see the data when I run a search query on the index I specified. Any clues?

0 Karma
Highlighted

Re: How to collect Slack logs

Splunk Employee
Splunk Employee

Are you collecting the syslog on the Splunk indexer, or forwarding it from the box with a syslog input to another Splunk box? Please include you inputs and outputs conf files.

0 Karma
Highlighted

Re: How to collect Slack logs

Engager

I am collecting syslogs on a heavy forwarder and then forwarding that off to Splunk Cloud indexers.

Inputs.conf
[udp://ip address here:514]
connection_host = dns
sourcetype = slack
index = slack
disabled = false

outputs.conf (is contained on a different app that outputs all )

[tcpout]
defaultGroup = splunkcloud
forwardedindex.2.whitelist = (audit|introspection|_internal)

[tcpout:splunkcloud]
server = splunkcloud addresses here :9997
compressed = false

0 Karma