Forwarding setup

[Adam Peterson]

I am a real Splunk newbie, and trying to figure out forwarding.

I've installed splunk on server1 and server2.  Server1 is my main server, and I want to forward data to it.  I've set up server2 to forward to server1, and server1 to receive from server2.  The log files confirm that they are talking to each other.

Now, how do I set up a data input, reading something like /var/log/messages and forward that data to server1?

Thanks in advance.

[Mark Sleeper]

Have you turned on lightweight forwarding on server2? If not you still have access to the web interface, that will make it easier to set it up. On server2 you need to go into Manager > Data Inputs > Files & Directories and add your /var/log directory. If you add /var/log instead of /var/log/messages you'll get all the other important sub-directories as well... like /var/log/secure!
Once you've added the directory and saved the configuration you should be able to use splunk on server1 to search the logs from server2. I don't remember how long it took before I started seeing the forwarded logs but I don't think it was over 15 minutes.
Mark