Getting Data In

Forwarding logs from AIX to Splunk on Windows?

ajayk
New Member

We have installed Splunk on Windows . We would like to forward log messages from AIX box to Splunk on Windows. However the forwarding is not working.

Looking at this - http://www.splunk.com/base/Documentation/latest/Deploy/Enableareceiver
I think, we have to install an app for AIX. Where can I find one ?

Tags (1)
0 Karma

mw
Splunk Employee
Splunk Employee

You need to configure some inputs:

# inputs.conf
[monitor:///var/log]
disabled=0
sourcetype=syslog

You need to configure the Universal forwarder to send events to the Splunk server:

# outputs.conf
[tcpout]
defaultGroup = group1
indexAndForward = false

[tcpout:group1]
server = splunk_server:9997
useACK = true
0 Karma

ajayk
New Member

We are using second scarnario. We are testing with application logs .. to start with.

Universalforwarder has been installed on AIX boxes. On windows 2003 Server 32 bit, We have Splunk listening on port 9997. However, the Universalforwarder is not able to forward the logs.

0 Karma

mw
Splunk Employee
Splunk Employee

You can either configure your Splunk instance to listen on udp:514 for syslog traffic, and configure the AIX systems to send syslog events to it via their built-in syslog service, or you can configure Splunk to receive forwarded data and install a forwarder on each AIX system ( http://www.splunk.com/download/universalforwarder ) which you'll then instruct to monitor all files in /var/log, as well as configuring it to forward data via outputs.conf

For the first scenario, you'll need this:

Receive syslog: http://www.splunk.com/base/Documentation/latest/Data/Monitornetworkports

For the second scenario, you'll need these:

Universal Forwarder download: http://www.splunk.com/download/universalforwarder

Monitor files: http://www.splunk.com/base/Documentation/latest/Data/Monitorfilesanddirectories

Forwarding and Receiving: http://www.splunk.com/base/Documentation/4.2.1/Deploy/Setupforwardingandreceiving

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...