All Apps and Add-ons

Splunk App for Unix and Linux: Why am I only able to see localhost activity?

rregeA
Engager

Hello,

I have installed and configured the Splunk App for Unix and Linix and the Splunk Add-on for Unix and Linux.

At the moment I can see on the dashboard only logs from the Spunk host itself. All my other nix servers logs are indexed in OS index.
Configured all the source types correctly, but i see only the Splunk localhost logs on those source types.

0 Karma
1 Solution

TStrauch
Communicator

Ok thats the reason why.

you defined the parameter sourcetype with values that are not known by the splunk app for *nix.

The searches are based on sourcetypes.

Take the inputs.conf provided with the Splunk_TA_nix and configure it on your ufs.

After this you have the correct sourcetypes defined the Splunk App for *nix will show results.

kind regards

View solution in original post

TStrauch
Communicator

Ok thats the reason why.

you defined the parameter sourcetype with values that are not known by the splunk app for *nix.

The searches are based on sourcetypes.

Take the inputs.conf provided with the Splunk_TA_nix and configure it on your ufs.

After this you have the correct sourcetypes defined the Splunk App for *nix will show results.

kind regards

TStrauch
Communicator

On which way the other nix logs get into your splunk environment?

0 Karma

rregeA
Engager

We use universal forwarders to send logs

0 Karma

TStrauch
Communicator

please give me an example of the input.conf stanza for your inputs on the uf´s

0 Karma

rregeA
Engager

[monitor:///var/log/auth.log]
index = os
sourcetype = Unix:Authorization

[monitor:///var/log/secure]
index = os
sourcetype = Unix:Authorization

[monitor:///var/log/alternatives.log]
index = os
sourcetype = Unix:Alternatives

[monitor:///var/log/dpkg.log]
index = os
sourcetype = Unix:DPKG

[monitor:///var/log/boot.log]
index = os
sourcetype = Unix:Boot

[monitor:///var/log/daemon.log]
index = os
sourcetype = Unix:Daemon

[monitor:///var/log/apache2/access.log]
index = os
sourcetype = Unix:ApacheAccess

Here is a sample of some inputs

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...