DATA INPUTS - monitor a file on a system that is not a Splunk LWF

Question

Is it possible to monitor a log file from a Linux system that is not configured as a LWF? I configured the Data Inputs via Splunkweb and the inputs.conf file

[monitor:///sunusr/slapd-eds1/logs/access]
host = eds1.host.DNS
disabled = false
index = eds

[monitor:///sunusr/slapd-eds1/logs/errors]
host = eds1..host.DNS
disabled = false
index = eds

[monitor://sunusr/slapd-eds1/logs/audit]
host = eds1..host.DNS
disabled = false
index = eds

The Splunkweb GUI validates that 1 file is available. Those files are also displayed in the Splunk list monitor, Although I am still not getting any data? When I search on that index there are no events. Nor has the index grown in size at all. Do I have to configure it as a LWF or what is the best way to monitor these files?

Please advise. Thank you

V

Answer 1

0

Any type of Splunk installation should be able to monitor files. Lightweight Forwarding simply means that the data isn't indexed locally but rather shipped to another indexer.

I assume that the "eds" index is properly configured on this system. Are there any warnings about these paths in splunkd.log?

link

answered 08 Jun '10, 02:12

Stephen Sorkin ♦
8.9k●5●10
accept rate: 52%

The Index configuration is correct. I have not installed Splunk on the eds1 system.I am trying to obtain the log files from the main indexer. EDS1 is a production system. Wonder if it may work by configuring the system to send the files over via a syslog function?

(08 Jun '10, 18:18) Voltaire

Answer 2

0

Syslog is a good option. You can configure a UDP or TCP input for that purpose using the Splunk Manager.

You should also be able to use NFS to mount the log files on the production server to your local filesystem, then just load Splunk on the server and point it to the correct folder.

link

answered 03 Aug '10, 09:25

stephanbuys
398●3●11
accept rate: 8%

Answer 3

I'm curious, is the /sunusr mounted directory from your Linux machine available on your indexer?

If not, I would suggest getting that mounted -- once mounted you should be right as rain.

If so, then I would suggest first testing your input on a directory that is local to ensure that your eds index is setup appropriately and you can in fact index the data you're trying to index.

Syslog is certainly an option but not necessary in this instance.

EDIT: Additionally, there are a couple of typos in your configuration.

[monitor://sunusr/slapd-eds1/logs/audit]

to

[monitor:///sunusr/slapd-eds1/logs/audit]

And beware the additional "." you have in your host entries.

DATA INPUTS - monitor a file on a system that is not a Splunk LWF

Follow this question

Splunk Resources

Related questions