0x00 背景
splunk 日常运维操作笔记。
0x01 场景
1.agent 安装
linux：
tar -zxvf splunkforwarder-8.0.3-a6754d8441bf-Linux-x86_64.tgz -C /opt
cp -r config /opt/splunkforwarder/etc/apps
vi /opt/splunkforwarder/etc/apps/prefix_app_inputs/local/inputs.conf
monitor:///home/var/log/\*log #修改监控路径
/opt/splunkforwarder/bin/splunk start --accept-license # 输入app账号密码
/opt/splunkforwarder/bin/splunk show deploy-poll # 检查配置文件是否配置好DS指向
/opt/splunkforwarder/bin/splunk enable boot-start # 开启自启动
2.splunk接入log（读取日志文件方式）
登录DS 后台
vim /opt/splunk/etc/development-apps/prefix_all_indexes/local/indexes.conf
新增索引 prefix_mailcasph
prefix_mailcasph homePath = volume:hotwarmdb/prefix_mailcasph/db coldPath = volume:colddb/prefix_mailcasph/colddb thawedPath = $SPLUNK_DB/prefix_mailcasph/thaweddb
inputs 负责数据采集，props负责数据解析
配置inputs文件夹
vim prefix_mailcasph_inputs/local/app.conf (这个一般参考default/app.conf 不做修改)
install
state = enabled
package
check_for_updates = false
ui
is_visible = false
is_manageable = false
vim prefix_mailcasph_inputs/local/inputs.conf
monitor://D:\\Exchange Server\\Logging\\HttpProxy\\Eas\\HttpProxy\*.log
index = prefix_mailcasph
sourcetype = ms:exchange:http_proxy
crcSalt = <SOURCE>
disabled = false
metadata 文件夹
local.meta：\[\]
access = read : \* , write : admin
export = system
配置props文件夹
vim prefix_mailcasph_inputs/local/app.conf
install
state = enabled
package
check_for_updates = false
ui
is_visible = false
is_manageable = false
props.conf (来自splunk论坛某篇文章)
ms:exchange:http_proxy
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
FIELD_DELIMITER=,
KV_MODE=none
SHOULD_LINEMERGE=false
disabled=false
TIMESTAMP_FIELDS=DateTime
TRANSFORMS-killheader1 = kh1
SHOULD_LINEMERGE=true
LINE_BREAKER=(\\r\\n+)\d{4}\-\d{2}\-\d{2}T
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ
MAX_TIMESTAMP_LOOKAHEAD = 25
NO_BINARY_CHECK=true
REPORT-extractfields = extractfields
transforms.conf (来自splunk论坛某篇文章)
kh1
REGEX = ^DateTime
DEST_KEY = queue
FORMAT = nullQueue
extractfields
DELIMS=","
FIELDS=DateTime,RequestId,MajorVersion,MinorVersion,BuildVersion,RevisionVersion,ClientRequestId,Protocol,UrlHo
st,UrlStem,ProtocolAction,AuthenticationType,IsAuthenticated,AuthenticatedUser,Organization,AnchorMailbox,UserA
gent,ClientIpAddress,ServerHostName,HttpStatus,BackEndStatus,ErrorCode,Method,ProxyAction,TargetServer,TargetSe
rverVersion,RoutingType,RoutingHint,BackEndCookie,ServerLocatorHost,ServerLocatorLatency,RequestBytes,ResponseB
ytes,TargetOutstandingRequests,AuthModulePerfContext,HttpPipelineLatency,CalculateTargetBackEndLatency,GlsLaten
cyBreakup,TotalGlsLatency,AccountForestLatencyBreakup,TotalAccountForestLatency,ResourceForestLatencyBreakup,To
talResourceForestLatency,ADLatency,SharedCacheLatencyBreakup,TotalSharedCacheLatency,ActivityContextLifeTime,Mo
duleToHandlerSwitchingLatency,ClientReqStreamLatency,BackendReqInitLatency,BackendReqStreamLatency,BackendProce
ssingLatency,BackendRespInitLatency,BackendRespStreamLatency,ClientRespStreamLatency,KerberosAuthHeaderLatency,
HandlerCompletionLatency,RequestHandlerLatency,HandlerToModuleSwitchingLatency,ProxyTime,CoreLatency,RoutingLat
ency,HttpProxyOverhead,TotalRequestTime,RouteRefresherLatency,UrlQuery,BackEndGenericInfo,GenericInfo,GenericEr
rors,EdgeTraceId,DatabaseGuid,UserADObjectGuid,PartitionEndpointLookupLatency,RoutingStatus
metadata 文件夹
local.meta：\[\]
access = read : \* , write : admin
export = system
DS 下发配置到CM
CM下发配置到indexer