All Apps and Add-ons

I need assistance on inputs.conf syntax for Linux log ingestion

Jarohnimo
Builder

Hello All,

I'm new to linux. I have experience using the deployment server and creating my own apps in Splunk to receive information sent to the index of my choice. I have a new requirement to fetch some linux data where I'm not too familiar and would like some assistance on the basic syntax for the deployment apps. Can someone please provide syntax examples for the deployment apps for the logs specified below so I can familiarize myself.

var/log/messages

var/log/secure

var/log/boot.log

var/log/yum.log

var/log/audit/(all files)

var/log/sa/(all files)

var/log/firewalld

I have the tomcat app however that setup process seems to be different and doesn't support deployment apps.

Please let me know if there are other apps I can use to make this process easier or if creating my own apps are best. Thank you!

0 Karma

sapanda
Path Finder

Hello @Jarohnimo ,

Below are a few links which will help you understand how to setup the inputs.conf file for you app to get data for Linux log messages into your splunk enterprise.

https://docs.splunk.com/Documentation/Splunk/7.2.3/Updating/Exampleaddaninputtoforwarders

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&utm_medium=i...

https://docs.splunk.com/Documentation/UnixAddOn/5.2.4/User/DeploytheSplunkAdd-onforUnixandLinuxinadi...

Hope this helps.

Thanks,
Sapan

0 Karma

FrankVl
Ultra Champion

Have a look at Splunk TA-nix: https://splunkbase.splunk.com/app/833/

This also includes a sample inputs.conf file if I recall correctly. That should give some inspiration (although likely needs tuning for the specific files as they exist on your linux box(es). That should also point you at what sourcetype to use.

But (assuming you have a splunk forwarder installed on the linux box(es)) basically you just need to create some file monitor inputs, see inputs.conf reference documentation for syntax.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...