Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
Forwarding setup
I am a real Splunk newbie, and trying to figure out forwarding.
I've installed splunk on server1 and server2. Server1 is my main server, and I want to forward data to it. I've set up server2 to forward to server1, and server1 to receive from server2. The log files confirm that they are talking to each other.
Now, how do I set up a data input, reading something like /var/log/messages and forward that data to server1?
Thanks in advance.
I've installed splunk on server1 and server2. Server1 is my main server, and I want to forward data to it. I've set up server2 to forward to server1, and server1 to receive from server2. The log files confirm that they are talking to each other.
Now, how do I set up a data input, reading something like /var/log/messages and forward that data to server1?
Thanks in advance.
Tags: Forwarders
Views: 127
Replies to This Discussion
-
Permalink Reply by Mark Sleeper on -
Have you turned on lightweight forwarding on server2? If not you still have access to the web interface, that will make it easier to set it up. On server2 you need to go into Manager > Data Inputs > Files & Directories and add your /var/log directory. If you add /var/log instead of /var/log/messages you'll get all the other important sub-directories as well... like /var/log/secure!
Once you've added the directory and saved the configuration you should be able to use splunk on server1 to search the logs from server2. I don't remember how long it took before I started seeing the forwarded logs but I don't think it was over 15 minutes.
Mark
© 2012 Created by Michael Wilde.
