no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
— | tech:others:splunk [2015/05/07 11:42] (current) – created - external edit 127.0.0.1 | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== Splunk ====== | ||
+ | ===== Install ===== | ||
+ | ==== Server (Host Name: | ||
+ | On the server download rpm file and run | ||
+ | <code bash> | ||
+ | rpm -ivh splunk-6.2.2-255606-linux-2.6-x86_64.rpm | ||
+ | </ | ||
+ | * Default user/ | ||
+ | * Default HTTP port is: 8000 | ||
+ | * Default Home: /opt/splunk | ||
+ | |||
+ | Full start-up log | ||
+ | < | ||
+ | # / | ||
+ | |||
+ | Splunk> Finding your faults, just like mom. | ||
+ | |||
+ | Checking prerequisites... | ||
+ | Checking http port [8000]: open | ||
+ | Checking mgmt port [8089]: open | ||
+ | Checking appserver port [127.0.0.1: | ||
+ | Checking kvstore port [8191]: open | ||
+ | Checking configuration... | ||
+ | Checking critical directories... | ||
+ | Checking indexes... | ||
+ | Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary | ||
+ | Done | ||
+ | Checking filesystem compatibility... | ||
+ | Checking conf files for problems... | ||
+ | Done | ||
+ | All preliminary checks passed. | ||
+ | |||
+ | Starting splunk server daemon (splunkd)... | ||
+ | Done | ||
+ | | ||
+ | |||
+ | Waiting for web server at http:// | ||
+ | |||
+ | |||
+ | If you get stuck, we're here to help. | ||
+ | Look for answers here: http:// | ||
+ | |||
+ | The Splunk web interface is at http:// | ||
+ | </ | ||
+ | |||
+ | ==== Agent (Host Name: | ||
+ | On the client download rpm file and run | ||
+ | <code bash> | ||
+ | rpm -ivh splunkforwarder-6.2.2-255606-linux-2.6-x86_64.rpm | ||
+ | </ | ||
+ | |||
+ | ===== Configuration ===== | ||
+ | ==== Server ==== | ||
+ | === Define Listen Port === | ||
+ | On the web console: | ||
+ | < | ||
+ | Setting -> Forwarding and Receiving -> Add Receiving -> Define listen Port (9997) | ||
+ | </ | ||
+ | === New Index === | ||
+ | Create new index rts on splunk enterprise web | ||
+ | === New Source Type === | ||
+ | In this example we are creating a new source type for haproxy as that is not available by default for splunk. Steps | ||
+ | * Copy / | ||
+ | * Created a new sourccetype block for haproxylog | ||
+ | < | ||
+ | [haproxylog] | ||
+ | category = Web | ||
+ | pulldown_type = true | ||
+ | EXTRACT-haproxy_httplog = haproxy\b.*? | ||
+ | NO_BINARY_CHECK = true | ||
+ | SHOULD_LINEMERGE = false | ||
+ | description = HAProxy single line log | ||
+ | disabled = false | ||
+ | </ | ||
+ | === Other settings === | ||
+ | Changed minimum disk free space required to 2GB from 5GB. | ||
+ | |||
+ | ==== Client ==== | ||
+ | === Configure to monitor haproxy.log === | ||
+ | Add forward server as the splunkserver on the designated port | ||
+ | <code bash> | ||
+ | / | ||
+ | </ | ||
+ | |||
+ | == Log forwarding == | ||
+ | Modify / | ||
+ | < | ||
+ | [default] | ||
+ | host = splunkclient | ||
+ | |||
+ | [monitor:/// | ||
+ | sourcetype = haproxylog | ||
+ | index = rts | ||
+ | </ | ||
+ | |||
+ | Modify / | ||
+ | < | ||
+ | [tcpout] | ||
+ | defaultGroup = default-autolb-group | ||
+ | |||
+ | [tcpout: | ||
+ | server = splunkserver: | ||
+ | |||
+ | [tcpout-server:// | ||
+ | </ | ||
+ | |||
+ | === Restart forwarder === | ||
+ | <code bash> | ||
+ | / | ||
+ | </ | ||