- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How can I transfer logs of a sever to an index...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I transfer logs of a sever to an indexer?
I have created an index A for server X and I have done all the required setting in the inputs.conf file of server X. I have checked that logs are monitored by Splunk through "Splunk list monitor" command but logs are not reaching to index.
What can be done?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
now you need to config your output.conf
first use this in your UF:
./splunk list forward-server
then
./splunk add forward-server :
and check if the port is open in your server
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ports are open i have checked already
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
inputs.conf is only part of the solution. This documentation page steps you through enabling the receiver on the indexer and adding a forward server on the forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have done all the configuration still i am on same page.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i know it sounds dumb, but did you restart your forwarder? It appears as active with this command?
./splunk list forward-server
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please share your
indexes.conf on the indexer
inputs.conf on the indexer
inputs.conf on the forwarder
props.conf on the forwarder
outputs.conf on the forwarder
that you have put in place for this task.
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
