Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

OSSEC confusion regarding how to get log data forwarded to Splunk

$
0
0
Hi, I currently have a ossec server running on my linux server with Splunk Forwarder installed on it as well. I have also downloaded the add-on and app for OSSEC in my Splunk indexer. **I have configured the ossec.conf file in my ossec server to:** $ipaddress9521default **And the Forwarder inputs.conf file:** [default] host = $hostname [monitor:///var/ossec/logs/alerts/alerts*] disabled = 0 index = myindex sourcetype = ossec_alerts [monitor:///var/ossec/logs/ossec.log] disabled = 0 index = myindex sourcetype = ossec_log [monitor:///var/ossec/logs/active-responses.log] disabled = 0 index = myindex sourcetype = ossec_ar How should i proceed the next step to get the data to my Splunk? Any help will be appreciated, thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>