Is it possible to monitor a log file from a Linux system that is not configured as a LWF? I configured the Data Inputs via Splunkweb and the inputs.conf file
The Splunkweb GUI validates that 1 file is available. Those files are also displayed in the Splunk list monitor, Although I am still not getting any data? When I search on that index there are no events. Nor has the index grown in size at all. Do I have to configure it as a LWF or what is the best way to monitor these files?
Please advise. Thank you
Any type of Splunk installation should be able to monitor files. Lightweight Forwarding simply means that the data isn't indexed locally but rather shipped to another indexer.
I assume that the "eds" index is properly configured on this system. Are there any warnings about these paths in splunkd.log?
answered 08 Jun '10, 02:12
Stephen Sorkin ♦
Syslog is a good option. You can configure a UDP or TCP input for that purpose using the Splunk Manager.
You should also be able to use NFS to mount the log files on the production server to your local filesystem, then just load Splunk on the server and point it to the correct folder.
answered 03 Aug '10, 09:25
I'm curious, is the /sunusr mounted directory from your Linux machine available on your indexer?
If not, I would suggest getting that mounted -- once mounted you should be right as rain.
If so, then I would suggest first testing your input on a directory that is local to ensure that your eds index is setup appropriately and you can in fact index the data you're trying to index.
Syslog is certainly an option but not necessary in this instance.
EDIT: Additionally, there are a couple of typos in your configuration.
And beware the additional "." you have in your host entries.
answered 18 Jan '11, 23:56