Here's a slight longer answer with pictures. Just wrote this up for a Splunk Cloud customer, thought I'd share with you guys:
If you haven’t setup a forwarder and a TA before, it’s a bit tricky.
You will need to download and install the forwarder, then install the Technology Add-on you can download it at apps.splunk.com. Make sure you get the TA not the app.
You should read this page, and specifically here, on how to setup your forwarder and Unix TA (Technology addon – that goes out and collects the lsof, netstat, vmstat etc… date)
The tricky part is : after you install the forwarder, and the TA, you still need to enable the inputs, so you can run this script:
$SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/Splunk_TA_nix/bin/setup.sh
You login using the default creds, assuming you haven’t changed them its admin / changeme
And that gives you a menu:
*** Splunk> *nix command-line setup > MAIN MENU ***
You are currently managing Splunk server 'localhost.localdomain'
Please choose from one of the following options:
1 - show *nix input status
2 - manage *nix inputs
3 - install/upgrade app
4 - change credentials
5 - connect to remote instance
0 - logout and exit program
Enter selection:
Select 2, and then you can just enable all, or whatever you want really.
*** Splunk> *nix command-line setup > MANAGE INPUTS ***
You are currently managing Splunk server 'localhost.localdomain'
Please choose from one of the following options:
1 - manage one input
2 - enable all inputs
3 - disable all inputs
4 - go back to main menu
0 - logout and exit program
Enter selection:
To start, probably choose #2, then we can tune it back later .
Then, After you ‘0’ you can return to your trial and hit up the app. You’ll see data now:
Regards,
Kyle
... View more
