I have a universal forwarder installed on Centos and logs are indexed in Splunk, but OS information is not passing through. What other configurations are needed to configure Splunk Add-on for Unix and Linux?
Find the inputs.conf details
[monitor:///var/log]
whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)
blacklist=(lastlog|anaconda\.syslog)
index=os
disabled = 0
[monitor:///opt/share]
whitelist=(\.log|log$)
index=w2
disabled = 0
[monitor:///var/log]
whitelist=(\.log|log$)
index=w2
disabled = 0
[monitor:///var/adm]
whitelist=(\.log|log$|messages)
index=os
disabled = 0
[monitor:///etc]
_whitelist=(\.conf|\.cfg|config$|\.ini|\.init|\.cf|\.cnf|shrc$|^ifcfg|\.profile|\.rc|\.rules|\.tab|tab$|\.login|policy$)
index=os
disabled = 0
### bash history
[monitor:///root/.bash_history]
disabled = false
sourcetype = bash_history
index = os
[monitor:///home/.../.bash_history]
disabled = false
sourcetype = bash_history
index = os
[monitor:///usr/local/mediaTechnology]
whitelist=(\.log|log$|\.out|\.txt)
index=nlp
disabled = 0
↧