Monitoring Splunk

How to setup / migrate a few Web server logs into Splunk

SamHTexas
Builder

How to setup / migrate a few Web server logs into Splunk. I need to set Splunk to ingest some web server logs into Splunk. Need step by step, if someone can help please

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SamHTexas,

try to follow these preliminary steps:

To take logs you can use:

in the first case

In the second case you have to:

  • create by CLI (Universal Frwarders hasn't a web interface) your own inputs.conf in $SPLUNK_HOME\etc\system\local (or $SPLUNK_HOME/etc/system/local on Linux), containing:
[monitor://C:\inetpub\logs\LogFiles]
disabled = false
sourcetype = ms:iis:auto
index = <preferred index>
  • Restart Splunk on Forwarder
  • check the logs.

I hint always the first one!

To better understand how to do this you can see https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Getstartedwithgettingdatain

there are also some interesting videos in YouTube to do this.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...