>> Hi, in this video,
we'll monitor data using
the universal forwarder we installed in a previous video.
To start off, we'll talk about what
Splunk configuration or comp files are,
then we'll go into an example of monitoring some files by
modifying inputs.com file on
the machine where I installed the universal forwarder.
Then we'll make sure we can
figure receiving on our Splunk server
in order to get these logs.
Many but not all configurations can
be done on Splunk web,
but if you want to pursue any Splunk administration,
you should know how to modify
these configuration files directly.
You do not want to change
comp files under the default folder,
instead create a new file under the local directory.
You might remember what it stanza
is from literature class.
In a splint configuration file,
stanzas are section that start with
brackets and contain configuration parameters.
Here's an example of two stanzas and a config file.
Sometimes you may need to restart
Splunk after making changes.
There are many different rules for when this occurs,
but if you aren't seeing your changes,
it may be because Splunk needs
restarted in order for them to take effect.
There are many important config files,
but inputs.com is a good one to work with.
This file is located under
Splunk home which is as a standard is
either opt/Splunk or program file
slash Splunk and then ETC system local.
I'm going to pull up the machine where I have
the universal forwarder installed.
I'm pretending there's important stuff
in this folder here and this logs
folder and I want to collect it and Splunk.
I've copied this file path over to this notepads
and it's in the right format for what we
would need to copy it into the inputs.com file.
Also, given it an index where I want this data to go,
I need to run notepad as
an administrator in order to save
these changes to the proper location
in the Splunk config files.
I'm going to right click on notepad
and hit Run as administrator and
now I can go file open
and browse to this PC going to C,
Program files, Splunk Universal Forwarder,
ETC system local and then I'm going to change this from.
TXT to all files and now we see these in here.
It automatically gave a host name in this
inputs.com file and now I
want to add these extra pieces in here.
I'm going to copy this in and click
''Save'' and then I'm going to open up services,
right click on the Splunk Forwarder Service
and click ''Restart''.
Now we want to make sure we're actually getting
this data into the Splunk web interface.
Before I jump back to my Splunk server,
I want to go through a few reminders.
When we installed the universal forwarder,
we said our deployments server was
the same machine as our search head and our indexer,
so we've got an all-in-one that
Splunk server is functioning multiple roles.
When we installed the universal forwarder,
we said that's our deployment server
and it uses the default management port of 8089.
We also set that machine as an indexer
that the forwarder would send data to over port 9997.
If we go to our Splunk server here,
we can go to settings for the management like
we did when we installed
the universal forwarder and
see that this host is reporting,
so it phoned home or it reported back a minute ago.
It's communicating to this instance
as a deployment server.
However, we're not going to
get any events that we just set up on
our universal forwarder because Splunk
isn't yet configured to receive events as an indexer.
If I open up a command prompt
here and run the netstat command,
we can see the 8089 port
is automatically set up and being listened on,
but there's nothing for port 9997.
To fix this, I'm going to go back here,
go to settings,
forwarding and receiving,
go to configure receiving
new receiving port and enter 9997,
which is what we set up on the universal forwarder to
send to you for this server as an indexer.
I'm going to save that. Now if
I open up that command prompt again,
run the netstat command again,
we see that is now listening on that port.
Now if we go to the search and reporting app,
we should be able to run a search for these events.
We set it up as indexer equals
miss and there's nothing here.
What needs to happen next is we never
actually configured that index,
so it's trying to send to an index that doesn't exist.
I'm going to go to Settings indexes
and we're going to create a new index.
We call that miss for miscellaneous.
We are going to save that
then go back to search and reporting.
The other thing that I need to do is hop over here
and actually put something in
this folder so now that this is being monitored,
I'm just going to save a random note in there so that we
have something to see on Splunk.
Now when I run the search,
we just got this last thing that I added.
This is a silly example,
but this is exactly
the same thing you would do if you were
getting logs in this folder and things like that.
From there, we could go and break out
the different fields like we talked
about in the last video,
but we've successfully got events into Splunk from
our universal forwarder that
we got by monitoring a file path.
After modifying a comp file,
you may need to blank
in order for the changes to take effect.
There are a few possible answers like save your work,
it's a good one, but the one I was
looking for was restart Splunk.
Thanks for watching. In the next video we'll start
Module 5 where we'll work to create alerts,
searches, reports, and dashboards.