Configure inputs via Splunk Web
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Configure inputs via Splunk Web
Follow these instructions to configure data inputs via Splunk Web. You can also configure data inputs via Splunk's CLI or a configuration file.
Configuration
- Click Admin in the upper right-hand corner of Splunk Web.
- Then click the Data Inputs Tab. Pick from the following input categories:
- All - Display and access to the following data inputs categories:
- FIles & Directories - Display and access configuration of each path being read by Splunk.
- FIFO Queues - Display and access configuration of each FIFO being processed by Splunk.
- Network Ports - Display and access configuration for UDP and TCP ports.
- Click the Add Inputs link next to a category to configure new inputs. Pick from the following options,
Files and directories
- Under the Source heading, pick a Data Access method:
- Spool:
- Copy a file on the server into Splunk via the sinkhole directory.
- Tail:
- A file or directory continuously monitored for new input to index.
- Upload:
- Upload a file from your local machine into Splunk.
- Watch and copy:
- Copy files from a directory into Splunk.
- Watch and symlink:
- Same as watch and copy; creates a symlink instead of copying the files.
- Then, specify the pathname to the file or directory. If you select the Upload method, you are presented with a Browse... button.
- Under the Host heading, select the host name. You have several choices if you are using Tail or Watch methods. Learn more about setting host value.
- Now set the Source Type. Source type is a default field added to events. Source type is used to determine processing characteristics such as timestamps and event boundaries. Learn more about setting source type.
- After specifying the source, host, and source type, click the Add button.
FIFO queues
- Under the Source heading, type in the path to the FIFO.
- Under the Host heading, accept the default host name or enter a new hostname/IP address.
- Under the Source Type heading choose:
- From List:
- select one of the pre-defined source types from the drop-down list.
- Manual:
- label your own source type in the text box.
- Click the Add button.
Network ports
With a Splunk Enterprise license, you can define input from any TCP or UDP port.
- Under the Source heading, select Protocol of UDP or TCP.
- Accept the default port, 9998, or enter another port number.
- Specify whether this port should accept connections from all hosts or one host.
- If you specify one host, enter the IP address of the host.
- Under the Source Type heading choose:
- From List:
- select one of the pre-defined source types from the drop-down list.
- Manual:
- label your own source type in the text box.
- Click the Add button.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 View the Article History for its revisions.