My audit logs are not being sent to splunk. The inputs.conf file is configured to monitor everything under /var/log. Please see below. Any assistance would be helpful, Thanks.
[monitor:///var/log]
disabled=false
index=linux
sourcetype=linux_messages_syslog
I also tried to specify the log in the inputs.conf file as seen below. But still no luck.
[monitor:///var/log/audit/audit.log]
disabled=false
index=linux
sourcetype=linux_audit
If/when you are running UF as non root user, you must give access to those logs to that specific user. You could check if this is the issue by trying to use less/more to see the content of those files by splunk user.
r. Ismo