Getting Data In

I am not recieving the logs of my linux machine

anshuman19
Explorer

I want to receive the logs of Linux machine having UF installed in my windows machine which have splunk enterprise free with domain account I edited the inputs.conf and outputs.conf as follows
ip of my Linux is suppose 192.168.5.007
ip of windows with port no I want to recieve is suppose 192.168.2.047:9997

In inputs.conf of splunk forwarder
[monitor:///path.../myfile]
index=INDEX_NAME

host = 192.168.5.007

sourcetype = linux:log

outputs.conf

[tcpout-server://192.168.2.047:9997]

compressed=false

In inputs.conf of splunk enterprise in windows

[splunktcp://9997]
disabled = 0

can some help me that if I have done every thing fine or I have to change any thing?
I edited the inputs.conf and outputs.conf of system\local.

0 Karma
1 Solution

mayurr98
Super Champion

hey @anshuman19
If you want to receive logs from linux machine then you must install universal forwarder on linux machine
As universal forwarder
1) tells the forwarder what data to send i.e. your_file
3) tells it where to send the data i.e. on windows machine

To get the data from from your linux machine

1)In inputs.conf of splunk forwarder i.e on linux machine /opt/etc/system/local/inputs.conf

monitor:///path.../myfile]
index =

host = 192.168.5.007
sourcetype = linux:log

2) For outputs.conf run below command on linux universal forwarder
./splunk add forward-server 192.168.2.047:9997
./splunk set deploy-poll 192.168.2.047:8089

3) On windows machine
Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
Read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
[splunktcp://9997]
disabled = 0

4) Restart universal forwarder on linux machine. go to /opt/splunkforwarder/bin and run
./splunk restart

5) search for your data on windows machine

This will work only if you have connectivity between windows(indexer) and linux(forwarder) machine with 9997 and 8089 ports

Let me know if this helps!

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nshuman19,
you can install Splunk Enterprise on a Windows server and monitor a Linux server, but Universal Forwarder must be installed on Linux server not on Windows server!
see http://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain for more information.

In few words:

  • install UF on Linux server,
  • configure outputs.conf on UF,
  • configure inputs.conf on UF,
  • enable receiving on Splunk Enterprise.

To configure inputs, the easiest way id to use Splunk_TA_Linux that you can find in apps.splunk.com.

Bye.
Giuseppe

0 Karma

anshuman19
Explorer

Thanks cusello

0 Karma

mayurr98
Super Champion

hey @anshuman19
If you want to receive logs from linux machine then you must install universal forwarder on linux machine
As universal forwarder
1) tells the forwarder what data to send i.e. your_file
3) tells it where to send the data i.e. on windows machine

To get the data from from your linux machine

1)In inputs.conf of splunk forwarder i.e on linux machine /opt/etc/system/local/inputs.conf

monitor:///path.../myfile]
index =

host = 192.168.5.007
sourcetype = linux:log

2) For outputs.conf run below command on linux universal forwarder
./splunk add forward-server 192.168.2.047:9997
./splunk set deploy-poll 192.168.2.047:8089

3) On windows machine
Configure the receiving port on Indexer (inputs.conf for receiving data on port say 9997)
Read details at http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver
[splunktcp://9997]
disabled = 0

4) Restart universal forwarder on linux machine. go to /opt/splunkforwarder/bin and run
./splunk restart

5) search for your data on windows machine

This will work only if you have connectivity between windows(indexer) and linux(forwarder) machine with 9997 and 8089 ports

Let me know if this helps!

0 Karma

anshuman19
Explorer

Thanks mayurr98

its works but I shut down my both system and again started next morning its not receiving any thing from that Linux machine what to do now?

0 Karma

mayurr98
Super Champion

have you enabled it as boot-start?
To enable automatic start on boot:

$SPLUNK_HOME/bin/splunk enable boot-start
do this on both the systems!

0 Karma

anshuman19
Explorer

I have done it in windows but in Linux it says that command not found

0 Karma

mayurr98
Super Champion

hey on linux you have to go to /opt/splunkforwarder/bin and then run ./splunk enable boot-start
you can refer this link if you have any query
https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/ConfigureSplunktostartatboottime#Enable_boo...

0 Karma

anshuman19
Explorer

ohk done, now it will directly fetch the data or we have to restart the forwarder?

0 Karma

mayurr98
Super Champion

yes it should..try and let me know !

0 Karma

anshuman19
Explorer

Thanks mayurr98 it's working!!

0 Karma

mayurr98
Super Champion

Hey, I am glad my answer helped you! pls, upvote my answer/comments whichever helped you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...