I've installed Splunk (4.1.5(85165) on windows) and have uploaded some logs without any issues.
I now want to monitor a linux server, but I'm having problems adding the datasource and always get the message:
Encountered the following error while trying to save: In handler 'monitor': Path must be absolute.
I'm using Splunk Web and have set the host field value to the two servers IP address and the full path on server to /var/log (and tried various other combinations).
On the Linux server I've added *.*@192.168.254.100 to syslog.conf.
I've read the manual, but it doesn't really help. and I'm finding a lack of tutorials. Pretty much thinking of abandoning the idea of Splunk now. I'm obviously missing some sort of basic information here. Can anyone help out? Being pointed in the direction of some decent tutorials would be good...
I'm having trouble understand how all this data gets sent to Splunk and how Splunk intercepts/retrieves it.
Splunk's "monitor" can only read files that are on the machine it's running on (or on drives mounted over the network that can be read from the machine it's running on). The "host" field may make it look like it can read from another machine, but it's there to identify what computer the file came from, not to connect to a remote host. This page has various ideas for setting up Splunk on a network. It looks like running Splunk on every machine and having them forward the logs to the central indexer is the "best practice", since it gives you access to log files not controlled by syslog (eg apache logs) and the local Splunk systems will hold the data if the main Splunk server goes down. Otherwise, if you're going to use syslog, this page provides some instructions on how to setup syslog-ng in windows to receive the syslog messages, then set up Splunk to read from syslog-ng.