Documentation: 3.3
|  Print Version Contents
This page last updated: 05/14/08 10:05pm

Configure inputs via Splunk Web

Follow these instructions to configure data inputs via Splunk Web. You can also configure data inputs via Splunk's CLI or a configuration file.

Configuration

  • Click Admin in the upper right-hand corner of Splunk Web.
  • Then click Data Inputs. Pick from the following input categories:
  • All - Display and access to the following data inputs categories:
    • FIles & Directories - Display and access configuration of each path being read by Splunk.
    • FIFO Queues - Display and access configuration of each FIFO being processed by Splunk.
    • Network Ports - Display and access configuration for UDP and TCP ports.

Files and directories

  • Click New Input to add an input.
  • Under Data access, pick one of the following:
    • Monitor a directory
      • A file or directory continuously monitored for new input to index.
    • Upload a local file
      • Upload a file from your local machine into Splunk.
    • Index a file on the Splunk server
      • Copy a file on the server into Splunk via the sinkhole directory.
  • Then, specify the pathname to the file or directory. If you select the Upload method, you are presented with a Browse... button.
  • Under the Host heading, select the host name. You have several choices if you are using Monitor or Watch methods. Learn more about setting host value.
  • Now set the Source Type. Source type is a default field added to events. Source type is used to determine processing characteristics such as timestamps and event boundaries. Learn more about setting source type.
  • After specifying the source, host, and source type, click the Add button.

FIFO queues

  • Click New Input to add an input.
  • Under Source, type in the path to the FIFO.
  • Under the Host heading, accept the default host name or enter a new hostname/IP address.
  • Under the Source Type heading choose:
    • From List:
      • select one of the pre-defined source types from the drop-down list.
    • Manual:
      • label your own source type in the text box.
  • Click the Add button.

Network ports

With a Splunk Enterprise license, you can set input from any TCP or UDP port.

  • Click New Input to add an input.
  • Under the Source heading, select Protocol of UDP or TCP.
  • Accept the default port, 9998, or enter another port number.
  • Specify whether this port should accept connections from all hosts or one host.
    • If you specify one host, enter the IP address of the host.
  • Under the Source Type heading choose:
    • From List:
      • select one of the pre-defined source types from the drop-down list.
    • Manual:
      • label your own source type in the text box.
  • Click the Add button.
Previous: How input configuration works    |    Next: Configure inputs via the CLI

Comments

  1. Is there any real documentation available for configuring inputs? How-to's? Examples?
    Posted by rementis on Aug 21 2008, 11:15am

  2. Everything in this section ("Data Inputs") and the next section ("Data Distribution") covers the variety of ways you can get files into Splunk. If you're not totally sure what you want, I highly recommend reading the overview pages of each section:

    http://www.splunk.com/doc/3.3/admin/InputConfig

    and

    http://www.splunk.com/doc/3.3/admin/ForwardingReceiving

    That should provide you with an idea of how different data inputs work, and link you to the appropriate section of the documentation.
    Posted by emma on Jul 21 2008, 9:49am

  3. The easiest way to get data from remote servers is to install a splunk instance on them and configure splunk to forward data to the central indexer (http://www.splunk.com/doc/current/admin/ForwardingReceiving). This will require that you run an enterprise on the indexer. If you don't want to run an enterprise license the best option is have syslog send the data over UDP or TCP.
    Posted by m@ on Jul 21 2008, 9:04am

  4. Is this all? Don't you provide any more documentation on how to configure inputs? How can I configure my Splunk server (on a linux machine) to get inputs from other machines (Linux AND windows).

    Is there a more detailed documentation, Howto, or anything on that topic? I'm trying arround for days now, but everything I got to work where local logs to get read.

    Thanks in advance,
    Patrick
    Posted by gigedi on Jul 21 2008, 3:00am

  5. kwyrick: could you be more specific about the information you're looking for? if you are having difficulty configuring inputs, you are also encouraged to contact support@splunk.com.
    Posted by rachel on Jul 16 2008, 9:45am

  6. Your documentation isn't very good. Why would I pay for a product that doesn't contain detailed documentation on configuring inputs?
    Posted by kwyrick on Jul 16 2008, 9:35am

Log in to comment.