FIFO inputs

FIFO inputs

Caution: Data sent via FIFO is not persisted in memory and can be an unreliable method for data sources. To ensure your data is not lost, use monitor instead.

Splunk Web

Add inputs from FIFOs via Splunk Web.

1. Click Admin in the upper right-hand corner of Splunk Web.

2. Then click Data Inputs.

3. Pick files and directories.

4. Click New Input to add an input.

5. Under Source, type in the path to the FIFO.

6. Under the Host heading, accept the default host name or enter a new hostname/IP address. Learn more about setting host value.

Note: Host only sets the host field in Splunk. It does not direct Splunk to look on a specific host on your network.

7. Now set the Source Type. Source type is a default field added to events. Source type is used to determine processing characteristics such as timestamps and event boundaries. Learn more about setting source type. Choose:

• From List
  • Select one of the pre-defined source types from the drop-down list.
• Manual
  • Label your own source type in the text box.

8. After specifying the source, host, and source type, click Submit.

CLI

Add a FIFO via Splunk's Command Line Interface (CLI). To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. Or add Splunk to your path and use the splunk command.

If you get stuck, Splunk's CLI has built-in help. Access the main CLI help by typing splunk help. Individual commands have their own help pages as well -- type splunk help <command>.

The following commands are available for input configuration via the CLI:

Command	Command syntax	Action
add	add fifo $SOURCE [-parameter value] ...	Add inputs from $SOURCE.
edit	edit fifo $SOURCE [-parameter value] ...	Edit a previously added input for $SOURCE.
remove	remove fifo $SOURCE	Remove a previously added $SOURCE.
list	list fifo	List the currently configured $SOURCE.

Parameter	Required?	Description
source	Required	Path to a FIFO or named pipe to index.
sourcetype	Optional	Specify a sourcetype field value for events from the input source.
index	Optional	Specify the destination index for events from the input source.
hostname	Optional	Specify a host name to set as the host field value for events from the input source.
hostregex	Optional	Specify a regular expression on the source file path to set as the host field value for events from the input source.
hostsegmentnum	Optional	Set the number of segments of the source file path to set as the host field value for events from the input source.

Example

This example shows how to enable a FIFO input, then set the host and sourcetype.

1. Add the FIFO /var/run/syslogfifo and set the sourcetype to linux_messages_syslog.

./splunk add fifo /var/run/syslogfifo -sourcetype linux_messages_syslog

2. Edit the input configuration to set the host to web01.

./splunk edit fifo /var/run/syslogfifo -hostname web01

inputs.conf

To add an input, add a stanza for it to inputs.conf in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. If you have not worked with Splunk's configuration files before, read how configuration files work before you begin.

You can set any number of attributes and values following an input type. If you do not specify a value for one or more attributes, Splunk uses the defaults that are preset in $SPLUNK_HOME/etc/system/default/ (noted below).

[fifo://<path>]

This input stanza type directs Splunk to read from a FIFO at the specified path.

host = <string>

• Set the host value of your input to a static value.
• host= is automatically prepended to the value when this shortcut is used.
• Defaults to the IP address of fully qualified domain name of the host where the data originated.
• For more information about the host field, see the host section.

index = <string>

• Set the index where events from this input will be stored.
• index= is automatically prepended to the value when this shortcut is used.
• Defaults to main (or whatever you have set as your default index).
• For more information about the index field, see the data management section.

sourcetype = <string>

• Set the sourcetype name of events from this input.
• sourcetype= is automatically prepended to the value when this shortcut is used.
• Splunk automatically picks a source type based on various aspects of your data. There is no hard-coded default.
• For more information about the sourcetype field, see the source type section.

source = <string>

• Set the source name of events from this input.
• Defaults to the file path.
• source= is automatically prepended to the value when this shortcut is used.

queue = <string> (parsingQueue, indexQueue, etc)

• Specify where the input processor should deposit the events that it reads.
• Can be any valid, existing queue in the pipeline.
• Defaults to parsingQueue.

• Was this topic useful?
• Post a comment