Getting Data In

How can I use a universal forwarder to send log files in specific directory to ArcSight?

bgamblin
Explorer

I am already sending *.debug syslog data to an ArcSight connector in rsyslog.conf. Now they want to monitor some application logs in a specific directory. I have installed the universal forwarder, but not really sure how to setup inputs.conf and outputs.conf to send the log files. Any help is greatly appreciated.

0 Karma

khourihan_splun
Splunk Employee
Splunk Employee

Hey B,

You can use monitor input's in your inputs.conf file, or use the CLI. See example 5 here.

Regarding outputs.conf, you want to add something like this into $SPLUNK_HOME/system/local/outputs.conf:

[tcpout]
defaultGroup=my_indexers

[tcpout:my_indexers]
server=mysplunk_indexer1:9997, mysplunk_indexer2:9997
autoLB = true

More info here.

Remember when editing .conf file, you need to restart the forwarder afterwards.

i.e. #splunk restart

Hope this helps,
Kyle

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...