Hello, I installed SA-nix, splunk_app_for_nix, Splunk_TA_nix for indexing all my Linux host system data. I have several questions about these three apps/add-ons Where I do I put my local inputs.conf and local indexes.conf ? SA-nix/local/[inputs.conf | indexes.conf ] splunk_app_for_nix/local/[inputs.conf | indexes.conf ] splunk_app_for_nix/install/SA-nix/local/[inputs.conf | indexes.conf ] splunk_app_for_nix/install/Splunk_TA_nix/local/[inputs.conf | indexes.conf ] Splunk_TA_nix/local/[inputs.conf | indexes.conf ] Which changes can it make according to these different locations of my inputs.conf or indexes.conf? Web interface of Splunk App For Unix In the settings parameters, I have configured my Linux Index(es) to contain Linux host data. Example: index=os index=sys_linux (which has all my linux syslog indexed with sourcetype=syslog) In this logic, Splunk App For Unix can display only all events in these indexes ... But in Metrics/Hosts tab, I can see Cisco events from other hosts which has been indexing in another index (index=net_cisco) and another sourcetype (sourcetype=cisco:ios) I don't understand why my Splunk App For Unix can display the information/events which from another index that doesn't concern Linux data. Any help is appreciated, thank you Marie ... View more

Hello, I have a Splunk server which is Indexer and SearchHead. All of the logs are splited to different file by rsyslog in front process. So i have all log in File format by host like : /var/rsyslog/HOST1 /var/rsyslog/HOST2 /var/rsyslog/HOST3 /var/rsyslog/HOST4 All input to Splunk is indexed by monitor file method for one or several file (broadcast /var/rsyslog/*) I installed three apps: - splunk_app_for_nix( included SA-nix, Splunk_TA_nix) dedicated for Linux, Unix systeme event dashbord. - cisco_ios (included TA-cisco_ios) dedicated for Cisco Switch event dashbord - Splunk_CiscoSecuritySuite (included Splunk_TA_cisco-asa) dedicated for ASA event dashbord My three input are : For splunk_app_for_nix --> splunk_app_for_nix/local/inputs.conf [monitor:///var/rsyslog/linux_HostName*] disabled = false host_segment = 4 index = index_nix sourcetype = syslog For cisco_ios ---> cisco_ios/local/inputs.conf [monitor:///var/rsyslog/cisco_switch_HostName*] disabled = false host = cisco_swith_HostName index = net_cisco sourcetype = syslog Splunk_CiscoSecuritySuite ---> Splunk_TA_cisco-asa/local/inputs.conf [monitor:///var/rsyslog/cisco_asa_HostaName*] disabled = false host = cisco_asa_Hostname index = net_asa sourcetype = syslog My Dashboard of cisco_ios and CiscoSecuritySuite are ok. All events are displayed correctly except the systeme nix . All log in index "index_nix" arent extracted correctly in according to nix extract. My question is how SPLUNK know the different "syslog" to use to adapt it to each kind of log : linux syslog, cisco ios syslog or cisco asa syslog ? Any help is appreciated. Thanks by advance. ... View more