Shulou(Shulou.com)06/03 Report--

1. Turn off the firewalls of all machines (mainly in Win7Splunk Server)

2. Install Splunk on 192.168.1.236

3. Install SplunkForward on 192.168.1.237

Deployment Server:192.168.1.236:8089

Receiving Indexer:192.168.1.236:9997

Choose the test log file written by yourself at Path to monitor.

4. Manager, forward and receive, configure receive, add, 9997

5. Search index=_internal source=*forwarder* and you will get data.

(there were about 2500 index=_internal searches when it was first installed.)

There is no entry to search for index=_internalsource=*forwarder* before installing Splunk Forward

6, default search, enter the matching character "*" (or index=default*) in the input box will search out the test log file written by yourself.

7. if it is a combination of multiple lines, modify a line in the test log file and search again

Or add apache log timestamp to the test log [16/May/2013:00:07:22]

Note data storage directory sent from 9997: C:\ Program Files\ Splunk\ var\ lib\ splunk\ defaultdb default index

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.