About Babelfish

Babelfish · ‎10-17-2020

Thank you @gcusello, I think that points me in the right direction. I searched for the logs and although the index is not set correctly (it is currently "main"), I can see that it is being forwarded correctly. My next steps will be to learn how to display the data, probably with a custom app so that I can create dashboards. Appreciate the help!

Babelfish · ‎10-16-2020

Thanks for your advice. On the heavy forwarder, I now have created the new app in /etc/deploymentapps, created the new serverclass with correct client (universal forwarder on Windows server) phoning home successfully. My next question is how to set this up in Splunk Cloud as a new app to get the data in. On the HF, under forwarding and receiving > forward data, I have multiple inputs<number>.<company>.splunkcloud.com:9997 which is I assume how data is being forwarded (I didn't set this up myself). Then in Splunk Cloud, what needs to be configured to get data from a specific app from the HF/deployment server? I tried creating a new app, but I don't see any way to tie it to a specific input, and the Splunk docs (eg: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2008/Data/UsingforwardingagentsCloud) don't really specify what needs to be done.

Babelfish · ‎10-16-2020

Deploying the TA on the Forwarder manually sounds like what I am trying to do. Just to summarise the current state: - Windows server is running Universal Forwarder service, in installation wizard I set the directory to monitor and gave the IP of the heavy forwarder on default port 8089. I restarted the service recently. - Heavy forwarder has /opt/splunk/etc/apps/<custom app>/ directory with both inputs.conf and app.conf files under "default" directory. Are you saying I need to restart this Linux VM running the heavy forwarder? - Splunk Cloud - does anything need to be configured here? Or the app will just show up?

Babelfish · ‎10-15-2020

Our deployment server is also the heavy forwarder. I'm not actually sure I need to deploy an app at all. All I am actually trying to do is monitor a log folder on the Windows server, send that to the heavy forwarder, which in turn sends up to Splunk Cloud. Is there an easier way to set this up?

Babelfish · ‎10-15-2020

Hi Splunk Community! I am completely new to Splunk and its configuration, so please excuse any lack of knowledge. I am trying to connect up a new custom app to our Splunk Cloud instance, however it is not showing up in the GUI. The end goal is to have data coming in from a universal forwarder on a Windows server to a Centos heavy forwarder, which then passes up the data to Splunk Cloud. A previous employee has successfully configured other custom apps, so I'm trying to follow the config. On the heavy forwarder, I have /opt/splunk/etc/apps/<custom app>/ directory with appserver, default, local, logs and metadata folders, copied from a sample app on the system. In both default and local folders, I have inputs.conf... ###################### [splunktcp://8089]connection_host = ip ###################### ...since the Windows universal forwarder is configured to send to this heavy forwarder on port 8089. I then edited /opt/splunk/etc/system/local/serverclass.conf to add this line... ###################### [serverClass:All Servers:app:<custom app>] restartSplunkWeb = 1 restartSplunkd = 1 stateOnClient = enabled ###################### ...and issued "splunk reload deploy-server". However, I am not seeing the app turn up on Splunk Cloud. I would really appreciate any push in the right direction as to what I have not configured correctly. Thank you!

Posts	5
Solutions	0
Karma Given	1
Karma Received	4
Member Since	‎10-15-2020

Online Status	Offline
Date Last Visited	‎10-19-2020 06:08 AM

Stuck on deploying a custom app

Re: Stuck on deploying a custom app

Re: Stuck on deploying a custom app

Re: Stuck on deploying a custom app

Re: Stuck on deploying a custom app

Stuck on deploying a custom app