Monitoring Splunk

How to setup / migrate a few Web server logs into Splunk

SamHTexas
Contributor

How to setup / migrate a few Web server logs into Splunk. I need to set Splunk to ingest some web server logs into Splunk. Need step by step, if someone can help please

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SamHTexas,

try to follow these preliminary steps:

To take logs you can use:

in the first case

In the second case you have to:

  • create by CLI (Universal Frwarders hasn't a web interface) your own inputs.conf in $SPLUNK_HOME\etc\system\local (or $SPLUNK_HOME/etc/system/local on Linux), containing:
[monitor://C:\inetpub\logs\LogFiles]
disabled = false
sourcetype = ms:iis:auto
index = <preferred index>
  • Restart Splunk on Forwarder
  • check the logs.

I hint always the first one!

To better understand how to do this you can see https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Getstartedwithgettingdatain

there are also some interesting videos in YouTube to do this.

Ciao.

Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!