splunkforwarder客户端部署

一官网下载

https://docs.splunk.com/Documentation/Splunk

2.1 基础信息

二开始部署splunkforwarder

server端：9997端口

基本配置文件

#输入采集
/data/splunkforwarder/etc/system/local/inputs.conf

#输出采集
/data/splunkforwarder/etc/system/local/outputs.conf

#主配置文件
/data/splunkforwarde/etc/system/local/server.conf

tar xf /tmp/splunkforwarder-8.0.5-a1a6394cc5ae-Linux-x86_64.tgz -C /data/

2.2 设置

#设置客户端的输出
/data/splunkforwarder/bin/splunk add forward-server 192.168.10.201:9997

#查看你的输出设置
/data/splunkforwarder/bin/splunk list forward-server

#注册客户端到服务器
/data/splunkforwarder/bin/splunk enable boot-start --accept-license

2.3 指定采集日志

#手动添加收集项：

/data/splunkforwarder/bin/splunk add monitor /var/log/mysql/error.log
/data/splunkforwarder/bin/splunk add monitor /var/log/httpd/error_log

#通过配置文件自动采集
#修改配置文件收集项
/data/splunkforwarder/etc/system/local/inputs.conf
[monitor:///data/ykd/logs/ykd-upms] //日志文件路径，可以使用正则表达式
index = ykd-upms //对应splunk web端设置的索引
sourcetype = sourceName   //数据类型可以不设置
disabled = false //开启自动同步
//有多个可以复制上面三行追加到后面
[monitor:///data/ykd/logs/ykd-gateway]
index = ykd-gateway
disabled = false

#修改输出到server端
/data/splunkforwarder/etc/system/local/outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 192.168.10.201:9997
[tcpout-server://192.168.10.201:9997]
===============================
#配置注册客户端到服务器-不配置server端无法感知到这个转发器的
/data/splunkforwarder/bin/splunk set deploy-poll 192.168.10.201:8089
#或者
/data/splunkforwarder/etc/system/local/deploymentclient.conf
[target-broker:deploymentServer]
targetUri = 192.168.10.201:8089

2.4 添加启动方式

//启动并同意splunk协议 
./splunk start --accept-license


#生成/etc/init.d/splunk 启动脚本，以后就可以这样启动了
/etc/init.d/splunk restart

#配置开机启动
/data/splunkforwarder/bin/splunk enable boot-start