Getting Data In

Forwarding logs from AIX to Splunk on Windows?

ajayk
New Member

We have installed Splunk on Windows . We would like to forward log messages from AIX box to Splunk on Windows. However the forwarding is not working.

Looking at this - http://www.splunk.com/base/Documentation/latest/Deploy/Enableareceiver
I think, we have to install an app for AIX. Where can I find one ?

Tags (1)
0 Karma

mw
Splunk Employee
Splunk Employee

You need to configure some inputs:

# inputs.conf
[monitor:///var/log]
disabled=0
sourcetype=syslog

You need to configure the Universal forwarder to send events to the Splunk server:

# outputs.conf
[tcpout]
defaultGroup = group1
indexAndForward = false

[tcpout:group1]
server = splunk_server:9997
useACK = true
0 Karma

ajayk
New Member

We are using second scarnario. We are testing with application logs .. to start with.

Universalforwarder has been installed on AIX boxes. On windows 2003 Server 32 bit, We have Splunk listening on port 9997. However, the Universalforwarder is not able to forward the logs.

0 Karma

mw
Splunk Employee
Splunk Employee

You can either configure your Splunk instance to listen on udp:514 for syslog traffic, and configure the AIX systems to send syslog events to it via their built-in syslog service, or you can configure Splunk to receive forwarded data and install a forwarder on each AIX system ( http://www.splunk.com/download/universalforwarder ) which you'll then instruct to monitor all files in /var/log, as well as configuring it to forward data via outputs.conf

For the first scenario, you'll need this:

Receive syslog: http://www.splunk.com/base/Documentation/latest/Data/Monitornetworkports

For the second scenario, you'll need these:

Universal Forwarder download: http://www.splunk.com/download/universalforwarder

Monitor files: http://www.splunk.com/base/Documentation/latest/Data/Monitorfilesanddirectories

Forwarding and Receiving: http://www.splunk.com/base/Documentation/4.2.1/Deploy/Setupforwardingandreceiving

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...