Getting Data In

Problems with File & Directory Monitoring

autovhcdev
New Member

I've installed Splunk (4.1.5(85165) on windows) and have uploaded some logs without any issues.

I now want to monitor a linux server, but I'm having problems adding the datasource and always get the message:

Encountered the following error while trying to save: In handler 'monitor': Path must be absolute.

I'm using Splunk Web and have set the host field value to the two servers IP address and the full path on server to /var/log (and tried various other combinations).

On the Linux server I've added *.*@192.168.254.100 to syslog.conf.

I've read the manual, but it doesn't really help. and I'm finding a lack of tutorials. Pretty much thinking of abandoning the idea of Splunk now. I'm obviously missing some sort of basic information here. Can anyone help out? Being pointed in the direction of some decent tutorials would be good...

I'm having trouble understand how all this data gets sent to Splunk and how Splunk intercepts/retrieves it.

0 Karma

treinke
Builder

For the Syslog, have you verified that the Windows server is not blocking UDP:514 in the firewall? Also, did you add UDP:514 to the Splunk ports input?

There are no answer without questions
0 Karma

treinke
Builder

When you are getting the error message, are you getting that on the agent on the linux system or are you trying to use an UNC path?

If it is local to the system, what is the path you are trying to enter to get that error (/var/log/)?

What linux flavor and version are you using?

There are no answer without questions
0 Karma

autovhcdev
New Member

The firewall is not blocking that port, and I've got a Data Input on UDP:514 - I had to restart and now it shows up in the data sources

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...