Getting Data In

Where are the inputs to my system?

gerryha
Explorer

I'm looking at this screen - it says "Data inputs" but lists a bunch of splunk home folders.

I thought splunk home would be where the data goes to, not where it comes from. I consider an "input" to be a "from", so makes no sense to me for splunk to be there.

I was expecting to see a bunch of systems and their log files as inputs, yet so far I cannot find any of (I just got admin and our splunk system seems to have a lot of everything, so it must be hidden in there somewhere).

splunk.png

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

I've looked at the "Datasets" - 168 of them and none seem to be what I am looking for.

Labels (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @gerryha,

answering to your questions, you have a list of H$SPLUNK_HOME folders because you're seeing the inputs of internal logs of the present server that depend on the installation path of you Splunk instance.

Infact you haven't only $SPLUNK_HOME folders but also a different one, if you search surely you'll find othe r input different than $SPLUNK_HOME.

But usually few inputs arrive from the Splunk instance and in [Settings > inputs] you can only see the local inputs, to see all the inputs you have to see the inputs in the addon-ons that you deployed to your Universal  and Heavy Forwarders.

To see them you should see in the apps located in Deployment Server at the folder $SPLUNK_HOME/etc/deployment-apps.

To see the sources of the logs that you ingested you can use the search hinted by @ITWhisperer , that I'd simplify using | metasearch:

| metasearch index=*
| stats count BY host source

In addition I think that is also relevant for you the host where the input is located, for this reason I added also host to the previous search.

Then, when you say "Full path to your data", it indicates the path "to reach" your data, but I could be agree with you that maybe "from" could be more correct.

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @gerryha,

answering to your questions, you have a list of H$SPLUNK_HOME folders because you're seeing the inputs of internal logs of the present server that depend on the installation path of you Splunk instance.

Infact you haven't only $SPLUNK_HOME folders but also a different one, if you search surely you'll find othe r input different than $SPLUNK_HOME.

But usually few inputs arrive from the Splunk instance and in [Settings > inputs] you can only see the local inputs, to see all the inputs you have to see the inputs in the addon-ons that you deployed to your Universal  and Heavy Forwarders.

To see them you should see in the apps located in Deployment Server at the folder $SPLUNK_HOME/etc/deployment-apps.

To see the sources of the logs that you ingested you can use the search hinted by @ITWhisperer , that I'd simplify using | metasearch:

| metasearch index=*
| stats count BY host source

In addition I think that is also relevant for you the host where the input is located, for this reason I added also host to the previous search.

Then, when you say "Full path to your data", it indicates the path "to reach" your data, but I could be agree with you that maybe "from" could be more correct.

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Files and directories are just one of the ways of getting data into splunk indexes. What you may be after is the sources for the events in the indexes - try something like this

index=*
| stats count by source
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...