From looking at the available apps, I see that this app is only available for Splunk Enterprise 5.x. I have a windows Server 2008 installed and want to get the events fed into Splunk in syslog format but more importantly I want some assistance with figuring out what the events logs are telling me. I don't want an app to monitor my Windows servers as I only have one server but do want an app that can help me figure out what the windows event logs are indicating. We have installed the Universal Forwarder on our Windows server but this only forwards the events and does nothing with formatting, so the logs look like 3 lines of info per event and not any more intuitive than reviewing them manually. ... View more

I'm getting data in syslog format with the host set to localhost. I know what server this is coming from but don't have authority to change the hostname at the server. The data is being put into a directory on my local server, not through UDP or TCP transfer. Here's what I have in inputs.conf [monitor:///home/Analysis/tc-1/server1/*.gz] index=tc-1 host=server1 disabled=false I've tried this both with and without sourcetype=syslog as added input here. A few of the records come in as host of server1 but most have localhost listed as the source. Any help would be appreciated. ... View more

I have multiple linux hosts sending syslog data (port 514) and want to split the data into different indexes based on ip address. I know I can set this up with each sending to a different port, but expect to have more hosts in future so sending to different ports based on ip address could become confusing. I created a props.conf with [192.168.17.3] sourcetype=abc [192.168.17.4] sourcetype=mail but how do I tell splunk to send data from 192.168.17.3 to index abc? ... View more