Getting Data In

Configure your inputs

To add a new type of data to your Splunk deployment, configure a data input. There are a number of ways to configure data inputs:

• Apps. Splunk has a variety of apps that offer preconfigured inputs for various data types. For more information, see Use apps to get data in.

• Splunk Web. You can configure most inputs using the Splunk Web data input pages. You can access the Add Data landing page from Splunk Home. In addition, when you upload or monitor a file, you can preview and make adjustments to how the file is to be indexed..

• The Splunk Command Line Interface (CLI). If you have Splunk Enterprise, you can use the CLI to configure most types of inputs.

• The inputs.conf configuration file. When you specify your inputs with Splunk Web or the CLI, the details are saved in a configuration file, inputs.conf. If you have Splunk Enterprise, you can edit that file directly. Some advanced data input needs might require you to edit it.

In addition, if you configure forwarders to send data from outlying machines to a central indexer, you can specify some inputs at installation time. See Use forwarders to get data in.

Use Splunk Web

You can add data inputs from Splunk Home or the Settings > Data Inputs menu

• From Splunk Home, select Add Data
• Select Settings > Add data
• Select Settings > Data inputs from the Data section of the Settings pop-up menu.

The Add Data page has options to get data in. Click an icon to go to a page to define the data you want to upload, monitor, or forward.

• Upload
• Monitor
• Forward

For more help on how to use the "Add Data" page, see How do you want to add data?

How app context determines where Splunk Enterprise writes configuration files

When you add an input through Splunk Web, Splunk Enterprise adds that input to a copy of inputs.conf. The app context, that is, the Splunk app you are currently in when you configure the input, determines where Splunk Enterprise writes the inputs.conf file.

For example, if you navigated to the Settings page directly from the Search page and then added an input, Splunk Enterprise adds the input to $SPLUNK_HOME/etc/apps/search/local/inputs.conf.

When you add inputs, confirm that you are in the app context that you want to be in. For background on how configuration files work, read About configuration files in the Admin manual.

Guided Data Onboarding

The Guided Data Onboarding (GDO) feature also provides end-to-end guidance for getting select data sources into specific Splunk platform deployments.

From your home page in Splunk Web, find the data onboarding guides by clicking Add Data. From there you can select a data source and configuration type. Then view diagrams, high-level steps, and documentation links that help you set up and configure your data source.

You can find all the Guided Data Onboarding manuals by clicking the Add data tab on the Splunk Enterprise Documentation site.

Use the CLI

If you have Splunk Enterprise, you can use the Splunk CLI to configure many inputs. From a shell or command prompt, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. For example, the following command adds /var/log/ as a data input:

splunk add monitor /var/log/

For more information on the CLI, including how to get command line help, see About the CLI in the Admin manual.

Edit inputs.conf

You can edit inputs.conf to configure your inputs. You use a text editor to create or modify the file, where you can add a stanza for each input. You can add the stanza to the inputs.conf file in $SPLUNK_HOME/etc/system/local/, or in your custom application directory (in $SPLUNK_HOME/etc/apps/<app name>/local).

You can configure the data input by adding key/value pairs to its stanza. You can set multiple settings in an input stanza. If you do not specify a value for a setting, Splunk Enterprise uses the default setting value. Default values for all inputs.conf attributes are in $SPLUNK_HOME/etc/system/default/inputs.conf.

If you have not worked with configuration files, see About configuration files. before starting to add inputs.

Example inputs.conf stanza

The following example configuration directs Splunk Enterprise to listen on TCP port 9995 for raw data from any remote host. Splunk Enterprise uses the DNS name of the remote host to set the host of the data. It assigns the source type "log4j" and the source "tcp:9995" to the data.

[tcp://:9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995

For information on how to configure a specific input, see the topic in this manual for that input. For example, to learn how to configure file inputs, see Monitor files and directories with inputs.conf.

The topic for each data input describes the main attributes available for that input. See the inputs.conf spec file for the complete list of available attributes, including descriptions of the attributes and several examples.