All Apps and Add-ons

I need assistance on inputs.conf syntax for Linux log ingestion


Hello All,

I'm new to linux. I have experience using the deployment server and creating my own apps in Splunk to receive information sent to the index of my choice. I have a new requirement to fetch some linux data where I'm not too familiar and would like some assistance on the basic syntax for the deployment apps. Can someone please provide syntax examples for the deployment apps for the logs specified below so I can familiarize myself.





var/log/audit/(all files)

var/log/sa/(all files)


I have the tomcat app however that setup process seems to be different and doesn't support deployment apps.

Please let me know if there are other apps I can use to make this process easier or if creating my own apps are best. Thank you!

0 Karma

Path Finder

Hello @Jarohnimo ,

Below are a few links which will help you understand how to setup the inputs.conf file for you app to get data for Linux log messages into your splunk enterprise.

Hope this helps.


0 Karma

Ultra Champion

Have a look at Splunk TA-nix:

This also includes a sample inputs.conf file if I recall correctly. That should give some inspiration (although likely needs tuning for the specific files as they exist on your linux box(es). That should also point you at what sourcetype to use.

But (assuming you have a splunk forwarder installed on the linux box(es)) basically you just need to create some file monitor inputs, see inputs.conf reference documentation for syntax.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...