reachport.blogg.se -

SPLUNK INPUTS.CONF DOCS HOW TO
SPLUNK INPUTS.CONF DOCS SOFTWARE
SPLUNK INPUTS.CONF DOCS CODE
SPLUNK INPUTS.CONF DOCS PASSWORD
SPLUNK INPUTS.CONF DOCS WINDOWS

See Assign the correct source types to your data. In addition, when you upload a file, you can preview and make adjustments to how Splunk Cloud Platform must index the file. You can access the Add Data page from the Splunk Web home page. You can configure some inputs using Splunk Web. For more information, see Use apps to get data in. You can use a variety of apps that offer preconfigured inputs, views, and knowledge objects for various use cases.

You can configure data inputs using the following methods: To add a new type of data to your Splunk platform instance, configure a data input. See What is Splunk knowledge? in the Knowledge Manager Manual. What do I want to do with the indexed data? See Use forwarders to get data in to Splunk Cloud. If you have a Splunk Cloud Platform instance, you might have to. See Is my data local or remote?ĭo I need to use forwarders to access remote data? For a Splunk Enterprise instance, data can be local or remote. See Use apps to get data in.įor a Splunk Cloud Platform instance, data is always remote, which means that you have to use a universal forwarder or HEC to get the data indexed into Splunk Cloud Platform. Use apps if they exist for the type of data you want to get in. If there is an app for the type of data you want to get in, you can save yourself considerable time in configuring and tweaking inputs on universal forwarders. Splunk and many third-party developers provide apps that facilitate and improve data ingestion.

SPLUNK INPUTS.CONF DOCS WINDOWS

On the other hand, if you want to ingest Windows data, you might want to use an app to help you get the data in. For example, if you want to get data in from a proprietary application, you might want to use the HTTP Event Collector (HEC). The type of data you want to index affects how you get data in. The best way depends on the location and volume of data, your infrastructure and security needs, and what you intend to do with that data.Īnswer the following questions to help you determine the best way to get data into your Splunk platform instance. Use the local directory for the app to overwrite behavior defined in the default directory.You can get data into your Splunk platform instance in a number of ways. my_db_poll.py writes the actual output from querying the database to another directory.Ĭonfigure scripted data input in $SPLUNK_HOME/etc//default/nf. The Splunk user has read and write access to this file.Ī single event from the script, for reference. my_db_poll.py writes the last_eventid after querying the database. Security for passwords is an issue when running scripts.įile containing a number for the last event received from the database. The Splunk Enterprise user has read and write access to this file.

SPLUNK INPUTS.CONF DOCS PASSWORD

Text file containing username and password encoded in base64 using the python function base64.b64encode(). You often have helper scripts that aid the main script. This is a type of helper script that formats data better for indexing. In this example, the stanza specifies how often to call the starter script to poll the database.Ī helper script to convert IP addresses from integer format to dotted format, and back. etc/apps//default/nf, create a stanza that references this wrapper script. In this example, it calls my_db_poll.py with the arguments needed to query the database. Wrapper script that calls the my_db_poll.py script. Queries the database at the next event and writes the output to a file.Reads last_eventid to determine the next event to read from the database.Accesses a database using credentials stored in key.

Queries the database and writes the query result to file.

This is the script that retrieves information from the database. The directory structure for your app might differ. Here is the directory structure of the example script for this example. Place scripts in the /bin directory of your app.

SPLUNK INPUTS.CONF DOCS SOFTWARE

Splunk software indexes the file containing the results of the queries.

Writes the output to a file in a format optimized for indexing.

Adapt this framework according to your needs. This example shows the framework for a commonly found script.

You can write any number and types of scripts in various scripting languages that perform various functions.

SPLUNK INPUTS.CONF DOCS CODE

That topic provides details on the example, including code examples in Python and Java. A more detailed version of this example is in Example script that polls a database. To illustrate the setup, it uses an example script that polls a database and writes the results to a file.

SPLUNK INPUTS.CONF DOCS HOW TO

This section describes how to set up a scripted input for an app.