Hi,
I am using Splunk on Ubuntu and edited the inputs.conf file to look at an IP address which I hope is working.
I want to look in the log file to test if its working but I am unable to locate which log files it would be located in.
Also if someone could post part of their inputs.conf file just so I can make sure I am inputting the stanza correctly that would be amazing.
Any help would be appreciated.
Thanks.
That'll listen for TCP data on port 23, so connection attempts without any data aren't going to show. This is for an application sending you splunkable data as a TCP stream.
Instead, you should get your local firewall to log these attempts and splunk the firewall logs.
If you didn't specify an index then they will end up in index=main. Look for tcp, that IP, and that port in the source field.
That'll listen for TCP data on port 23, so connection attempts without any data aren't going to show. This is for an application sending you splunkable data as a TCP stream.
Instead, you should get your local firewall to log these attempts and splunk the firewall logs.
Thanks Someoni2, thats very helpful.
Hi Martin,
This is my inputs.conf posted.
[default]
host = mahmud-X551CA
[tcp:192.168.1.88:23]
Which I think may have been incorrect accroding to the file that someoni2 posted.
And sorry for the bad description of look at an IP adress. I should of said look for any data recieved from a specific IP Address.
I am currently doing a university project and I am trying to find out how Splunk can alert me if any connections or data is received from specific IP addresses without using any apps.
Thanks.
Thanks Martin,
I will use it both ways and see if their is a difference on how Splunk displays the ouput. One more question, where do I find the logs to display these specific results. I have quite a lot of log files but they do not seem to be reffereing to the rule that I have set.
You can see the example inputs.conf from the documentation. See this
http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Inputsconf#inputs.conf.example
You can search questions with "inputs.conf" to see more samples in this forum.
Do post your inputs.conf settings - for example, I'm not quite sure what you mean by "look at an IP address".