Getting Data In

Reading Drupal syslog with Splunk

88mac
New Member

Hi, I have set the syslog Drupal and I followed this guide: http://www.asmallwebfirm.net/blogs/2013/04/achieving-drupal-log-bliss-splunk
Without the syslog drupal configuration, now I want to read log files (which I set in the syslog var / log / drupal.log folder) with Splunk.
Can you help to set Splunk to read the log drupal?

Tags (1)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

I have no idea what your Splunk experience is, but:

Install a Splunk Forwarder on the Drupal server to forward data from the forwarder to the Splunk Server. This means there is a properly configured outputs.conf that knows where to send the data. Also ensure your Splunk Server has receiving enabled on port 9997 by default.

On the forwarder you also need an inputs.conf:

[monitor:///var/log/drupal.log]
sourcetype=drupal

Once you restart the forwarder it should start sending logs to your Splunk server. I hope this helps.

View solution in original post

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

I have no idea what your Splunk experience is, but:

Install a Splunk Forwarder on the Drupal server to forward data from the forwarder to the Splunk Server. This means there is a properly configured outputs.conf that knows where to send the data. Also ensure your Splunk Server has receiving enabled on port 9997 by default.

On the forwarder you also need an inputs.conf:

[monitor:///var/log/drupal.log]
sourcetype=drupal

Once you restart the forwarder it should start sending logs to your Splunk server. I hope this helps.

0 Karma

88mac
New Member

I use on Drupal, the file rsyslog.conf.
At the end of this file, I put in this code:
local0.* /var/log/drupal.log
local0.* @@ip:ports

Splunk now it enables the port, but nothing happens. Splunk does not see the Drupal data

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

If you are sending data to Splunk on UDP or TCP, in Splunk on the indexers did you enable data inputs/udp or data inputs/tcp on port 514?

0 Karma

88mac
New Member

Then I go on Splunk on "Forwarding and receiving", "Receive data" and imposed on port 514? Correct?

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

No. Settings/Forwarding and Receiving is when you use forwarders on port 9997 (default).

Settings/Data Inputs/UDP or TCP is where you add 514 with rsyslog.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...