# Version 9.2.2.20240415 # ############################################################################ # OVERVIEW ############################################################################ # This file contains possible settings you can use to configure inputs, # distributed inputs such as forwarders, and file system monitoring in # inputs.conf. # # Each stanza controls different search commands settings. # # There is an inputs.conf file in the $SPLUNK_HOME/etc/system/default/ directory. # Never change or copy the configuration files in the default directory. # The files in the default directory must remain intact and in their original # location. # # To set custom configurations, create a new file with the name inputs.conf in # the $SPLUNK_HOME/etc/system/local/ directory. Then add the specific settings # that you want to customize to the local configuration file. # For examples, see inputs.conf.example. # # You must restart the Splunk platform instance to enable configuration changes. # # To learn more about configuration files (including file precedence) see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles # ############################################################################ # GLOBAL SETTINGS ############################################################################ # Use the [default] stanza to define any global settings. # * You can also define global settings outside of any stanza, at the top of # the file. # * Each .conf file should have at most one default stanza. If there are # multiple default stanzas, settings are combined. In the case of # multiple definitions of the same setting, the last definition in the # file wins. # * If a setting is defined at both the global level and in a specific # stanza, the value in the specific stanza takes precedence. # * Do not add any new global settings to the [default] stanza unless you # understand all the repercussions of your changes. It is especially # important not to add new settings if your inputs.conf file is created # in an app that has global permissions or is located in the # $SPLUNK_HOME/etc/system directory. # * Modifying the inputs.conf file might cause other apps or splunkd to fail. ############################################################################ # GENERAL SETTINGS: # The following settings are valid for all input types (except file system # change monitor, which is described in a separate section in this file). # You must first enter a stanza header in square brackets, specifying the input # type. See later in this file for examples. Then, use any of the # following settings. # # To specify global settings for Windows Event Log inputs, place them in # the [WinEventLog] global stanza as well as the [default] stanza. ############################################################################ host = * Sets the host key/field to a static value for this input stanza. * The input uses this field during parsing and indexing. It also uses this field at search time. * As a convenience, the input prepends the chosen string with 'host::'. * When set to '$decideOnStartup', sets the field to the hostname of executing machine. The hostname is checked and the field set at every splunkd startup. * If you run multiple instances of the software on the same machine (hardware or virtual machine), choose unique values for 'host' to differentiate your data, ex. myhost-sh-1 or myhost-idx-2. * Do not put the value in quotes. Use host=foo, not host="foo". * When 'host' is set to "$decideOnStartup", you can further control how splunkd derives the hostname by using the 'hostnameOption' setting in server.conf. * For example, if you want splunkd to use the fully qualified domain name for the machine, set "host = $decideOnStartup" in inputs.conf and "hostnameOption = fullyqualifiedname" in server.conf. * More information on hostname options can be found in the server.conf specification file. * If you remove the 'host' setting from $SPLUNK_HOME/etc/system/local/inputs.conf or remove $SPLUNK_HOME/etc/system/local/inputs.conf, the setting reverts to "$decideOnStartup". Apps that need a resolved host value should use the 'host_resolved' property in the response for the REST 'GET' call of the input source. This property is set to the hostname of the local Splunk instance. It is a read only property that is not written to inputs.conf. * Default: "$decideOnStartup" run_only_one= * Determines if a scripted or modular inputs runs on one search head in SHC. * Currently not supported. This setting is related to a feature that is still under development. * Default: true index = * Sets the index to store events from this input. * Primarily used to specify the index to store events that come in through this input stanza. * Default: main (or whatever you have set as your default index) source = * Sets the source key/field for events from this input. * Detail: Sets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. * As a convenience, the chosen string is prepended with 'source::'. * Avoid overriding the source key. The input layer provides a more accurate string to aid in problem analysis and investigation, recording the file from which the data was retrieved. Consider using source types, tagging, and search wildcards before overriding this value. * Do not put the value in quotes: Use source=foo, not source="foo". * Default: the input file path sourcetype = * Sets the sourcetype key/field for events from this input. * Explicitly declares the source type for this input instead of letting it be determined through automated methods. This is important for search and for applying the relevant configuration for this data type during parsing and indexing. * Sets the sourcetype key initial value. The key is used during parsing or indexing to set the source type field during indexing. It is also the source type field used at search time. * As a convenience, the chosen string is prepended with 'sourcetype::'. * Do not put the value in quotes: Use sourcetype=foo, not sourcetype="foo". * If not set, the indexer analyzes the data and chooses a source type. * No default. queue = [parsingQueue|indexQueue] * Sets the queue where the input processor deposits the events it reads. * Set to "parsingQueue" to apply the props.conf file and other parsing rules to your data. For more information about the props.conf file and rules timestamps and linebreaks, see the props.conf file and the online documentation at http://docs.splunk.com/Documentation. * Set to "indexQueue" to send your data directly into the index. * Default: parsingQueue # Pipeline Key defaulting. * Pipeline keys in general can be defaulted in inputs stanzas. * The list of user-available, modifiable pipeline keys is described in transforms.conf.spec. See transforms.conf.spec for further information on these keys. * The currently-defined keys which are available literally in inputs stanzas are as follows: queue = _raw = _meta = _time = * Inputs have special support for mapping host, source, sourcetype, and index to their metadata names such as host -> Metadata:Host * Defaulting these values is not recommended, and is generally only useful as a workaround to other product issues. * Defaulting these keys in most cases overrides the default behavior of input processors, but this behavior is not guaranteed in all cases. * Values defaulted here, as with all values provided by inputs, can be altered by transforms at parse time. ############################################################################ # This section contains options for routing data using inputs.conf rather than # outputs.conf. # # NOTE: Concerning routing via inputs.conf: # This is a simplified set of routing options you can use as data comes in. # For more flexible options or details on configuring required or optional # settings, see outputs.conf.spec. ############################################################################ _TCP_ROUTING = * A comma-separated list of tcpout group names. * This setting lets you selectively forward data to one or more specific indexers. * Specify the tcpout group that the forwarder uses when forwarding the data. The tcpout group names are defined in outputs.conf with [tcpout:]. * To forward data to all tcpout group names that have been defined in outputs.conf, set to '*' (asterisk). * To forward data from the "_internal" index, you must explicitly set '_TCP_ROUTING' to either "*" or a specific splunktcp target group. * Default: The groups specified in 'defaultGroup' in [tcpout] stanza in the outputs.conf file _SYSLOG_ROUTING = * A comma-separated list of syslog group names. * Use this setting to selectively forward the data to specific destinations as syslog events. * Specify the syslog group to use when forwarding the data. The syslog group names are defined in outputs.conf with [syslog:]. * The destination host must be configured in outputs.conf, using "server=[|]:". * This setting does not work on a universal forwarder. * Default: The groups specified in 'defaultGroup' in the [syslog] stanza in the outputs.conf file _INDEX_AND_FORWARD_ROUTING = * If set for any input stanza, causes all data coming from that input stanza to be labeled with this setting. * When 'selectiveIndexing' is in use on a forwarder: * Data without this label will not be indexed by that forwarder. * Data with this label will be indexed in addition to any forwarding. * This setting does not actually cause data to be forwarded or not forwarded in any way, nor does it control where the data is forwarded in multiple-forward path cases. * Only has effect if you use the 'selectiveIndexing' feature in outputs.conf. * Default: not set ############################################################################ # Deny list ############################################################################ [blacklist:] * Protects files on the file system from being indexed or previewed. * The input treats a file as denied if the file starts with any of the defined deny list . * Adding a file to the deny list with the specified path occurs even if a monitor stanza defines an allow list that matches the file path. * The preview endpoint returns an error when asked to preview an excluded file. * The oneshot endpoint and command also returns an error. * When a denied file is monitored, using monitor:// or batch://, the 'filestatus' endpoint shows an error. * For fschange with the 'sendFullEvent' option enabled, contents of denied files are not indexed. ############################################################################ # Input types ############################################################################ Valid input stanzas, along with their input-specific settings, follow: ############################################################################ # MONITOR: ############################################################################ [monitor://] * Configures a file monitor input to watch all files in the you specify. * can be an entire directory or a single file. * You must specify the input type and then the path, so put three slashes in your path if you are starting at the root on *nix systems (to include the slash that indicates an absolute path). # Additional settings: host_regex = * If specified, extracts host from the path to the file for each input file. * Detail: This feature examines the source key; if source is set explicitly in the stanza, that string is matched, not the original filename. * Specifically, the first group of the regular expression (regex) is used as the host. * If the regex fails to match, the input uses the default 'host' setting. * If 'host_regex' and 'host_segment' are both set, the input ignores 'host_regex'. * No default. host_segment = * If set to N, the Splunk platform sets the Nth "/"-separated segment of the path as 'host'. * For example, if you set "host_segment = 3" and the path is /logs/servers/host08/abc.txt, the third segment, "host08", is used. * If the value is not an integer or is less than 1, the default 'host' setting is used. * On Windows machines, the drive letter and colon before the backslash *does not* count as one segment. * For example, if you set "host_segment = 3" and the monitor path is D:\logs\servers\host01, Splunk software sets the host as "host01" because that is the third segment. * No default. whitelist = * If set, files from this input are monitored only if their path matches the specified regular expression. * Takes precedence over the deprecated '_whitelist' setting, which functions the same way. * No default. blacklist = * If set, files from this input are NOT monitored if their path matches the specified regex. * Takes precedence over the deprecated '_blacklist' setting, which functions the same way. * If a file matches the regexes in both the deny list and allow list settings, the file is NOT monitored. Deny lists take precedence over allow lists. * No default. NOTE concerning wildcards and monitor: * You can use wildcards to specify your input path for monitored inputs. Use "..." for recursive directory matching and "*" for wildcard matching in a single directory segment. * "..." searches recursively through one or more directories. This means that /foo/.../bar matches foo/1/bar, foo/1/2/bar, etc. * You can use multiple "..." specifications in a single input path. For example: /foo/.../bar/... * The asterisk (*) matches anything in a single path segment; unlike "...", it does not search recursively. For example, /foo/*/bar matches the files /foo/1/bar, /foo/2/bar, etc. However, it does not match /foo/bar or /foo/1/2/bar. A second example: /foo/m*r/bar matches /foo/mr/bar, /foo/mir/bar, /foo/moor/bar, etc. It does not match /foo/mi/or/bar. * You can combine "*" and "..." as needed: foo/.../bar/* matches any file in the bar directory within the specified path. * A monitor stanza path will interpret regular expression metacharacters as strings unless they are preceded by the wildcard values "*" or "..." in a prior segment of the path. * In the case where multiple unique monitor inputs overlap through the use of wildcards or specific paths defined in the monitor stanza, the Splunk platform processes the files using the monitor stanza that is the closest specific match. crcSalt = * Use this setting to force the input to consume files that have matching CRCs, or cyclic redundancy checks. * By default, the input only performs CRC checks against the first 256 bytes of a file. This behavior prevents the input from indexing the same file twice, even though you might have renamed it, as with rolling log files, for example. Because the CRC is based on only the first few lines of the file, it is possible for legitimately different files to have matching CRCs, particularly if they have identical headers. * If set, is added to the CRC. * If set to the literal string "" (including the angle brackets), the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC. When 'crcSalt' is invoked, it is usually set to . * Be cautious about using this setting with rolling log files; it could lead to the log file being re-indexed after it has rolled. * In many situations, 'initCrcLength' can be used to achieve the same goals. * Default: empty string initCrcLength = * How much of a file, in bytes, that the input reads before trying to identify whether it has already seen the file. * You might want to adjust this if you have many files with common headers (comment headers, long CSV headers, etc) and recurring filenames. * Cannot be less than 256 or more than 1048576. * CAUTION: Improper use of this setting causes data to be re-indexed. You might want to consult with Splunk Support before adjusting this value - the default is fine for most installations. * Default: 256 (bytes) ignoreOlderThan = [s|m|h|d] * The monitor input compares the modification time on files it encounters with the current time. If the time elapsed since the modification time is greater than the value in this setting, Splunk software puts the file on the ignore list. * Files on the ignore list are not checked again until the Splunk platform restarts, or the file monitoring subsystem is reconfigured. This is true even if the file becomes newer again at a later time. * Reconfigurations occur when changes are made to monitor or batch inputs through Splunk Web or the command line. * Use 'ignoreOlderThan' to increase file monitoring performance when monitoring a directory hierarchy that contains many older, unchanging files, and when removing or adding a file to the deny list from the monitoring location is not a reasonable option. * Do NOT select a time that files you want to read could reach in age, even temporarily. Take potential downtime into consideration! * Suggested value: 14d, which means 2 weeks * For example, a time window in significant numbers of days or small numbers of weeks are probably reasonable choices. * If you need a time window in small numbers of days or hours, there are other approaches to consider for performant monitoring beyond the scope of this setting. * NOTE: Most modern Windows file access APIs do not update file modification time while the file is open and being actively written to. Windows delays updating modification time until the file is closed. Therefore you might have to choose a larger time window on Windows hosts where files may be open for long time periods. * Value must be: . For example, "7d" indicates one week. * Valid units are "d" (days), "h" (hours), "m" (minutes), and "s" (seconds). * No default, meaning there is no threshold and no files are ignored for modification time reasons followTail = * Whether or not the input should skip past current data in a monitored file for a given input stanza. * This setting lets you skip over data in files, and immediately begin indexing current data. * If you set to "1", monitoring starts at the end of the file (like *nix 'tail -f'). The input does not read any data that exists in the file when it is first encountered. The input only reads data that arrives after the first encounter time. * If you set to "0", monitoring starts at the beginning of the file. * This is an advanced setting. Contact Splunk Support before using it. * Best practice for using this setting: * Enable this setting and start the Splunk instance. * Wait enough time for the input to identify the related files. * Disable the setting and restart the instance. * Do not leave 'followTail' enabled in an ongoing fashion. * Do not use 'followTail' for rolling log files (log files that get renamed as they age) or files whose names or paths vary. * Default: 0 alwaysOpenFile = * Whether or not an input opens a file to check whether it has already been indexed, by skipping the modification time and size checks. * Only useful for files that do not update modification time or size. * Only known to be needed when monitoring files on Windows, mostly for Internet Information Server logs. * Configuring this setting to "1" can increase load and slow indexing. Use it only as a last resort. * Default: 0 time_before_close = * The amount of time, in seconds, that the file monitor must wait for modifications before closing a file after reaching an End-of-File (EOF) marker. * Tells the input not to close files that have been updated in the past 'time_before_close' seconds. * Default: 3 multiline_event_extra_waittime = * Whether or not the file monitor input delays sending an event delimiter when it reads a file with multiple-line events, to account for the time it sometimes takes for lines of those events to arrive. * By default, the file monitor sends an event delimiter when: * It reaches EOF of a file it monitors and * The last character it reads is a newline. * In some cases, it takes time for all lines of a multiple-line event to arrive. * Set to "true" to delay sending an event delimiter until the time that the file monitor closes the file, as defined by the 'time_before_close' setting, to allow all event lines to arrive. * Default: false recursive = * Whether or not the input monitors subdirectories that it finds within a monitored directory. * A value of "true" means the input monitors sub-directories. * A value of "false" means the input does not monitor sub-directories. * Default: true followSymlink = * Whether or not the input follows any symbolic links within a monitored directory. * A value of "true" means the input follows symbolic links and monitors files at the symbolic link destination. * Additionally, any allow lists or deny lists that the input stanza defines also apply to files at the symbolic link destination. * A value of "false" means the input ignores symbolic links that it finds within a monitored directory. * Default: true _whitelist = ... * DEPRECATED. * This setting is valid unless the 'whitelist' setting also exists. _blacklist = ... * DEPRECATED. * This setting is valid unless the 'blacklist' setting also exists. ############################################################################ # BATCH ("Upload a file" in Splunk Web): ############################################################################ Use the 'batch' input for large archives of historic data. If you want to continuously monitor a directory or index small archives, use 'monitor' (see the MONITOR section). 'batch' reads in the file and indexes it, and then deletes the file on disk. [batch://] * A one-time, destructive input of files in . * This stanza must include the 'move_policy = sinkhole' setting. * This input reads and indexes the files, then DELETES THEM IMMEDIATELY. * For continuous, non-destructive inputs of files, use 'monitor' instead. # Additional settings: move_policy = sinkhole * This setting is required. You *must* include "move_policy = sinkhole" when you define batch inputs. * This setting causes the input to load the file destructively. * CAUTION: Do not use the 'batch' input type for files you do not want to delete after indexing. * The 'move_policy' setting exists for historical reasons, but remains as a safeguard. As an administrator, you must explicitly declare that you want the data in the monitored directory (and its sub-directories) to be deleted after being read and indexed. host_regex = see the definition in the MONITOR section. host_segment = see the definition in the MONITOR section. crcSalt = see the definition in the MONITOR section. time_before_close = see the definition in the MONITOR section. log_on_completion = * Whether or not the Splunk platform writes an entry into the splunkd.log file when it indexes files with this input. * When set to "false", this setting prevents the Splunk platform from writing to splunkd.log when it indexes files with this input. * Default: true # 'batch' inputs do not use the following setting: # source = followSymlink = * Works similarly to the same setting for monitor, but does not delete files after following a symbolic link out of the monitored directory. # The following settings work identically as for [monitor::] stanzas, # documented previously host_regex = host_segment = crcSalt = recursive = whitelist = blacklist = initCrcLength = time_before_close = ############################################################################ # TCP: Transport Control Protocol (TCP) network inputs ############################################################################ [tcp://:] * Configures the input to listen on a specific TCP network port. * If a makes a connection to this instance, the input uses this stanza to configure itself. * If you do not specify , this stanza matches all connections on the specified network port. * Generates events with source set to "tcp:", for example: tcp:514 * If you do not specify a sourcetype, the input generates events with sourcetype set to "tcp-raw". # Additional settings: connection_host = [ip|dns|none] * How the network input sets the host field for the events it generates. * A value of "ip" sets the host to the IP address of the system sending the data. * A value of "dns" sets the host to the reverse DNS entry for the IP address of the system that sends the data. For this to work correctly, set the forward DNS lookup to match the reverse DNS lookup in your DNS configuration. * A value of "none" leaves the host as specified in inputs.conf, typically the hostname of the system running Splunk software. * Default: dns queueSize = [KB|MB|GB] * The maximum size of the in-memory input queue. * Default: 500KB persistentQueueSize = [KB|MB|GB|TB] * The maximum size of the persistent queue file. * Persistent queues can help prevent loss of transient data. For information on persistent queues and how the 'queueSize' and 'persistentQueueSize' settings interact, search the online documentation for "persistent queues". * If you set this to a value other than 0, then 'persistentQueueSize' must be larger than either the in-memory queue size (as defined by the 'queueSize' setting in inputs.conf or 'maxSize' settings in [queue] stanzas in server.conf). * Default: 0 (no persistent queue) requireHeader = * Whether or not to require a header be present at the beginning of every stream. * This header can be used to override indexing settings. * Default: false listenOnIPv6 = [no|yes|only] * Whether or not the input listens on IPv4, IPv6, or both protocols. * Set to "yes" to listen on both IPv4 and IPv6 protocols. * Set to "only" to listen on only the IPv6 protocol. * Default: The setting in the [general] stanza of the server.conf file acceptFrom = * A list of TCP networks or addresses to accept connections from. * Use commas or spaces to separate multiple network rules. * The accepted formats for network and address rules are: 1. A single IPv4 or IPv6 address (examples: "192.0.2.3", "2001:db8::2:1") 2. A Classless Inter-Domain Routing (CIDR) block of addresses (examples: "192.0.2/24", "2001:DB8::/32") 3. A DNS name. Use "*" as a wildcard. (examples: "myhost.example.com", "*.example.org") 4. The wildcard "*" matches anything. * A prefix of '!' for an entry sets a rule to deny and reject connections. The ACL applies rules in order, and uses the first matching rule. For example, the rules "!192.0.2/24, *" prevents connections from the 192.0.2/24 network, but accepts all other connections. * Default: * (accept from anywhere) rawTcpDoneTimeout = * The amount of time, in seconds, that a network connection can remain idle before Splunk software declares that the last event over that connection has been received. * If a connection over this port remains idle for more than 'rawTcpDoneTimeout' seconds after receiving data, it adds a Done-key. This declares that the last event has been completely received. * Default: 10 [tcp:] * Configures the input listen on the specified TCP network port. * This stanza is similar to [tcp://:], but listens for connections to the specified port from any host. * Generates events with a source of tcp:. * If you do not specify a sourcetype, generates events with a source type of tcp-raw. * This stanza supports the following settings: connection_host = [ip|dns|none] queueSize = [KB|MB|GB] persistentQueueSize = [KB|MB|GB|TB] requireHeader = listenOnIPv6 = [no|yes|only] acceptFrom = rawTcpDoneTimeout = ############################################################################ # Data distribution: ############################################################################ # Global settings for splunktcp. Used on the receiving side for data forwarded # from a forwarder. [splunktcp] route = [has_key|absent_key::;...] * Settings for the light forwarder. * The receiver sets these parameters automatically -- you do not need to set them yourself. * The property route is composed of rules delimited by ';' (semicolon). * The receiver checks each incoming data payload through the cooked TCP port against the route rules. * If a matching rule is found, the receiver sends the payload to the specified . * If no matching rule is found, the receiver sends the payload to the default queue specified by any queue= for this stanza. If no queue= key is set in the stanza or globally, the receiver sends the events to the parsingQueue. enableS2SHeartbeat = * Specifies the global keepalive setting for all splunktcp ports. * This option is used to detect forwarders which might have become unavailable due to network, firewall, or other problems. * The receiver monitors each connection for presence of a heartbeat, and if the heartbeat is not seen for 's2sHeartbeatTimeout' seconds, it closes the connection. * Default: true (heartbeat monitoring enabled) s2sHeartbeatTimeout = * The amount of time, in seconds, that a receiver waits for heartbeats from forwarders that connect to this instance. * The receiver closes a forwarder connection if it does not receive a heartbeat for 's2sHeartbeatTimeout' seconds. * Default: 600 (10 minutes) inputShutdownTimeout = * The amount of time, in seconds, that a receiver waits before shutting down inbound TCP connections after it receives a signal to shut down. * Used during shutdown to minimize data loss when forwarders are connected to a receiver. * During shutdown, the TCP input processor waits for 'inputShutdownTimeout' seconds and then closes any remaining open connections. * If all connections close before the end of the timeout period, shutdown proceeds immediately, without waiting for the timeout. stopAcceptorAfterQBlock = * The amount of time, in seconds, to wait before closing the splunktcp port. * If the receiver is unable to insert received data into the configured queue for more than the specified number of seconds, it closes the splunktcp port. * This action prevents forwarders from establishing new connections to this receiver. * Forwarders that have an existing connection will notice the port is closed upon test-connections and move to other receivers. * After the queue unblocks, and the TCP input can continue processing data, the receiver starts listening on the port again. * This setting should not be adjusted lightly as extreme values can interact poorly with other defaults. * NOTE: If there are multiple tcp/splunktcp listener ports configured, all listening ports will be shut down regardless of whether other queues are blocked or not. * Default: 300 (5 minutes) listenOnIPv6 = no|yes|only * See the description for this setting in the [tcp://:] stanza. acceptFrom = * See the description for this setting in the [tcp://:] stanza. negotiateProtocolLevel = * If set, lets forwarders that connect to this receiver (or specific port) send data using only up to the specified feature level of the Splunk forwarder protocol. * If set to a value that is lower than the default, denies the use of newer forwarder protocol features during connection negotiation. This might impact indexer efficiency. * Default (if 'negotiateNewProtocol' is "true"): 1 * Default (if 'negotiateNewProtocol' is not "true"): 0 negotiateNewProtocol = * DEPRECATED. * Use the 'negotiateProtocolLevel' setting instead. * Controls the default configuration of the 'negotiateProtocolLevel' setting. * Default: true concurrentChannelLimit = * The number of unique channel codes that are available for forwarders to use to communicate with an indexer. * Each forwarder that connects to this indexer may use up to 'concurrentChannelLimit' unique channel codes. * In other words, each forwarder may have up to 'concurrentChannelLimit' channels in flight concurrently. * The receiver closes a forwarder connection if a forwarder attempts to exceed this value. * This setting only applies when the new forwarder protocol is in use. * Default: 300 logRetireOldS2S = * Whether or not the Splunk platform logs the usage of old versions of Splunk-to-Splunk (S2S) protocol. * The old S2S protocol retirement logs provide visibility into customers' usage of the old S2S protocol version V3 which is less performant than the current version V4. * A value of "true" means that splunkd generates warning logs for the old S2S protocol versions. * See the 'logRetireOldS2SRepeatFrequency' setting for additional constraints on when the Splunk platform logs the use of old S2S protocol versions. * Default: true logRetireOldS2SMaxCache = * The size of the cache for tracking forwarders that use old S2S protocols. * The cache keeps track of unique forwarders that use the old S2S protocol. When a forwarder is in the cache, the Splunk platform doesn't log usage of the old protocol for that forwarder for a time period of 'logRetireOldS2SRepeatFrequency', to avoid generating duplicate logs. * If the cache fills before the 'logRetireOldS2SRepeatFrequency' period elapses, the Splunk platform removes the forwarder that has been in the cache the longest from the cache to make space. * Update this setting as per the number of forwarders that currently use the old S2S protocol to send data to indexers. If the number of forwarders that use old S2S protocols is larger than the cache size, some forwarders might generate duplicate logs even though the previous log was within the 'logRetireOldS2SRepeatFrequency' period. * When you restart Splunk Enterprise, the cache resets and the timer starts over. * This setting takes effect only when 'logRetireOldS2S' has a value of "true". * Default: 10000 logRetireOldS2SRepeatFrequency = * The interval between writing repeat entries into the retire old S2S warning log for a certain forwarder. * This setting helps reduce retire old S2S log size by providing control over how often to log. * When a forwarder uses the old S2S protocol version to communicate with splunkd, splunkd adds the forwarder to a cache. Subsequent communication with the same forwarder won't generate a new entry to the log until a period of 'logRetireOldS2SRepeatFrequency' has elapsed. Splunkd then resets the log timestamp and writes another "retire old S2S protocol" warning log entry. * The Splunk platform enforces this setting as long as the size of the cache does not exceed 'logRetireOldS2SMaxCache' entries. When there are more than 'logRetireOldS2SMaxCache' entries, the cache removes the entry with the oldest access time to make space. * When you restart Splunk Enterprise, the cache resets and the timer starts over. * This setting takes effect only when 'logRetireOldS2S' has a value of "true". * A value of "0" means that the platform logs old S2S protocol warning entries every time it receives a communication using the old S2S protocol version. * Default: 1d # Forwarder-specific settings for splunktcp. [splunktcp://[]:] * Receivers use this input stanza. * This is the same as the [tcp://] stanza, except the remote server is assumed to be a Splunk instance, most likely a forwarder. * is optional. If you specify it, the receiver listens only for data from . * Use of is not recommended. Use the 'acceptFrom' setting, which supersedes this setting. connection_host = [ip|dns|none] * For splunktcp, the 'host' or 'connection_host' is be used if the remote Splunk instance does not set a host, or if the host is set to "::". * "ip" sets the host to the IP address of the system sending the data. * "dns" sets the host to the reverse DNS entry for IP address of the system that sends the data. For this to work correctly, set the forward DNS lookup to match the reverse DNS lookup in your DNS configuration. * "none" leaves the host as specified in inputs.conf, typically the Splunk system hostname. * Default: ip compressed = * Whether or not the receiver communicates with the forwarder in compressed format. * Applies to non-Secure Sockets Layer (SSL) receiving only. There is no compression setting required for SSL. * A value of "true" means the receiver communicates with the forwarder in compressed format. * If set to "true", there is no longer a requirement to also set "compressed = true" in the outputs.conf file on the forwarder. * Default: false enableS2SHeartbeat = * Specifies the keepalive setting for the splunktcp port. * This option is used to detect forwarders which might have become unavailable due to network, firewall, or other problems. * The receiver monitors the connection for presence of a heartbeat, and if it does not see the heartbeat in 's2sHeartbeatTimeout' seconds, it closes the connection. * This overrides the default value specified at the global [splunktcp] stanza. * Default: true (heartbeat monitoring enabled) s2sHeartbeatTimeout = * The amount of time, in seconds, that a receiver waits for heartbeats from forwarders that connect to this instance. * The receiver closes the forwarder connection if it does not see a heartbeat for 's2sHeartbeatTimeout' seconds. * This overrides the default value specified at the global [splunktcp] stanza. * Default: 600 (10 minutes) queueSize = [KB|MB|GB] * The maximum size of the in-memory input queue. * Default: 500KB negotiateProtocolLevel = * See the description for this setting in the [splunktcp] stanza. negotiateNewProtocol = * See the description for this setting in the [splunktcp] stanza. concurrentChannelLimit = * See the description for this setting in the [splunktcp] stanza. [splunktcp:] * This input stanza is the same as [splunktcp://[]:], but the input accepts connections from any server. * See the online documentation for [splunktcp://[]:] for more information on the following supported settings: connection_host = [ip|dns|none] compressed = enableS2SHeartbeat = s2sHeartbeatTimeout = queueSize = [KB|MB|GB] negotiateProtocolLevel = negotiateNewProtocol = concurrentChannelLimit = # Access control settings. [splunktcptoken://] * Use this stanza to specify forwarders from which to accept data. * You must configure a token on the receiver, then configure the same token on forwarders. * The receiver discards data from forwarders that do not have the token configured. * This setting is enabled for all receiving ports. * This setting is optional. * NOTE: When specifying a , you must use a specific format, as follows: NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN. Failure to use this format results in the token being ignored. * For example, 'A843001F-B2B5-4F94-847D-D07802685BB2' token = * The value of the token. * Must be in the format NNNNNNNN-NNNN-NNNN-NNNN-NNNNNNNNNNNN. Failure to use this string format results in the token being ignored. # SSL settings for data distribution: [splunktcp-ssl:] * Use this stanza type if you are receiving encrypted, parsed data from a forwarder. * Set to the port on which the forwarder sends the encrypted data. * Forwarder settings are set in outputs.conf on the forwarder. * Compression for SSL is enabled by default. On the forwarder you can still specify compression with the 'useClientSSLCompression' setting in outputs.conf. * The 'compressed' setting is used for non-SSL connections. However, if you still specify 'compressed' for SSL, ensure that the 'compressed' setting is the same as on the forwarder, as splunktcp protocol expects the same 'compressed' setting from forwarders. connection_host = [ip|dns|none] * See the description for this setting in the [splunktcp:] stanza. * Default: ip compressed = * See the description for this setting in the [splunktcp:] stanza. enableS2SHeartbeat = * See the description for this setting in the [splunktcp:] stanza. s2sHeartbeatTimeout = * See the description for this setting in the [splunktcp:] stanza. listenOnIPv6 = [no|yes|only] * Select whether this receiver listens on IPv4, IPv6, or both protocols. * Set to "yes" to listen on both IPv4 and IPv6 protocols. * Set to "only" to listen on only the IPv6 protocol. * Default: The setting in the [general] stanza of the server.conf file acceptFrom = * See the description for this setting in the [tcp://:] stanza. negotiateProtocolLevel = * See the description for this setting in the [splunktcp] stanza. negotiateNewProtocol = * See the description for this setting in the [splunktcp] stanza. concurrentChannelLimit = * See the description for this setting in the [splunktcp] stanza. # To specify global ssl settings, that are applicable for all ports, add the # settings to the SSL stanza. # Specify any ssl setting that deviates from the global setting here. # For a detailed description of each ssl setting, refer to the [SSL] stanza. serverCert = sslPassword = requireClientCert = sslVersions = cipherSuite = ecdhCurves = dhFile = allowSslRenegotiation = sslQuietShutdown = sslCommonNameToCheck = , , ... sslAltNameToCheck = , , ... useSSLCompression = [tcp-ssl:] * Use this stanza type if you are receiving encrypted, unparsed data from a forwarder or third-party system. * Set to the port on which the forwarder/third-party system is sending unparsed, encrypted data. * To create multiple SSL inputs, you can add the following attributes to each [tcp-ssl:] input stanza. If you do not configure a certificate in the port, the certificate information is pulled from the default [SSL] stanza: * serverCert = * sslRootCAPath = Only add this setting if you have not configured the 'sslRootCAPath' setting in server.conf. * sslPassword = listenOnIPv6 = [no|yes|only] * Select whether the receiver listens on IPv4, IPv6, or both protocols. * Set to "yes" to listen on both IPv4 and IPv6 protocols. * Set to "only" to listen on only the IPv6 protocol. * If not present, the receiver uses the setting in the [general] stanza of server.conf. acceptFrom = * See the description for this setting in the [tcp://:] stanza. * Default: "*" (accept from anywhere) # To specify global SSL settings, that are applicable for all ports, add the # settings to the SSL stanza. # Specify any SSL setting that deviates from the global setting here. # For a detailed description of each ssl setting, refer to the [SSL] stanza. serverCert = sslPassword = requireClientCert = sslVersions = cipherSuite = ecdhCurves = dhFile = allowSslRenegotiation = sslQuietShutdown = sslCommonNameToCheck = , , ... sslAltNameToCheck = , , ... useSSLCompression = ############################################################################ # SSL: ############################################################################ [SSL] * Set the global specifications for receiving Secure Sockets Layer (SSL) communication underneath this stanza name. serverCert = * The full path to the server certificate file. * This file must be a Privacy-Enhanced Mail (PEM) format file. * PEM is the most common text-based storage format for SSL certificate files. * No default. sslPassword = * The server certificate password, if it exists. * Set this to a plain-text password initially. * Upon first use, the input encrypts and rewrites the password to $SPLUNK_HOME/etc/system/local/inputs.conf. password = * DEPRECATED. * Do not use this setting. Use the 'sslPassword' setting instead. rootCA = * DEPRECATED. * Do not use this setting. Use 'server.conf/[sslConfig]/sslRootCAPath' instead. * Used only if 'sslRootCAPath' is not set. * The path must refer to a PEM format file that contains one or more root CA certificates that have been concatenated together. requireClientCert = * Whether or not a client must present an SSL certificate to authenticate. * A value of "true" means that clients must present a certificate to authenticate. * Default (if using self-signed and third-party certificates): false * Default (if using the default certificates; overrides the existing "false" setting): true sslVersions = * A list of SSL versions to support. * The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2" * The special version "*" selects all supported versions. The version "tls" selects all versions that begin with "tls". * To remove a version from the list, prefix it with "-". * SSLv2 is always disabled. Specifying "-ssl2" in the version list has no effect. * When configured in Federal Information Processing Standard (FIPS) mode, the "ssl3" version is always disabled, regardless of this configuration. * The default can vary. See the 'sslVersions' setting in $SPLUNK_HOME/etc/system/default/inputs.conf for the current default. supportSSLV3Only = * DEPRECATED. * SSLv2 is now always disabled. * Use the 'sslVersions' setting to set the list of supported SSL versions. cipherSuite = * If set, uses the specified cipher string for the input processors. * Must specify 'dhFile' to enable any Diffie-Hellman ciphers. * The default can vary. See the 'cipherSuite' setting in $SPLUNK_HOME/etc/system/default/inputs.conf for the current default. ecdhCurveName = * DEPRECATED. * Use the 'ecdhCurves' setting instead. * This setting specifies the Elliptic Curve Diffie-Hellman (ECDH) curve to use for ECDH key negotiation. * Splunk software only supports named curves that have been specified by their SHORT name. * The list of valid named curves by their short and long names can be obtained by running this CLI command: $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves * Default: empty string ecdhCurves = * A list of ECDH curves to use for ECDH key negotiation. * The curves should be specified in the order of preference. * The client sends these curves as a part of an SSL Client Hello. * The server supports only the curves specified in the list. * Splunk software only supports named curves that have been specified by their SHORT names. * The list of valid named curves by their short and long names can be obtained by running this CLI command: $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves * Example setting: "ecdhCurves = prime256v1,secp384r1,secp521r1" * The default can vary. See the 'ecdhCurves' setting in $SPLUNK_HOME/etc/system/default/inputs.conf for the current default. dhFile = * Full path to the Diffie-Hellman parameter file. * DH group size should be no less than 2048 bits. * This file is required in order to enable any Diffie-Hellman ciphers. * No default. dhfile = * DEPRECATED. * Use the 'dhFile' setting instead. * Yes, the setting name is case-sensitive. allowSslRenegotiation = * Whether or not to let SSL clients renegotiate their connections. * In the SSL protocol, a client might request renegotiation of the connection settings from time to time. * A value of "false" means the server rejects all renegotiation attempts, which breaks the connection. * This limits the amount of CPU a single TCP connection can use, but it can cause connectivity problems, especially for long-lived connections. * Default: true sslQuietShutdown = * Enables quiet shutdown mode in SSL. * Default: false logCertificateData = * Whether or not the Splunk platform logs certificate data for Transport Layer Security (TLS) certificates. * The certificate data logs provide visibility into the certificates in use for the Splunk-to-Splunk (S2S) channel. The logs collect data such as common name (CN), issuer name, SHA256 fingerprint, serial number, and validity dates. * A value of "true" means that splunkd generates logs for TLS certificates. * Refer to the 'certLogRepeatFrequency' setting for additional constraints on when the Splunk platform logs certificate data. * Default: true certLogMaxCacheEntries = * The size of the cache for tracking certificate entries. * The cache keeps track of the certificates for a time period of 'certLogRepeatFrequency' to avoid generating duplicate logs. * If the cache fills before the 'certLogRepeatFrequency' period elapses, the cache removes the entry with the oldest access time to make space. * Update this setting as per the number of forwarders that are sending data to indexers. If the number of forwarders is larger than the cache size, some of the certificates might generate duplicate logs even though the previous log was within the 'certLogRepeatFrequency' period. * When you restart Splunk Enterprise, the cache resets and the timer starts over. * This setting takes effect only when 'logCertificateData' has a value of 'true'. * Default: 10000 certLogRepeatFrequency = * The interval between writing repeat entries into the certificate data log for a certain certificate. * This setting helps reduce certificate data log size by providing control over how often to log certificate data. * When the Splunk platform receives a certificate the first time in a TLS connection, it adds the certificate to a cache. Subsequent connections with the same certificate won't generate a new entry to the log until a period of 'certLogRepeatFrequency' has passed. After this amount of time elapses, splunkd resets the log timestamp and writes another certificate log entry. * The Splunk platform enforces this setting as long as the size of the cache does not reach 'certLogMaxCacheEntries'. When there are more than 'certLogMaxCacheEntries', the cache removes the entry with the oldest access time to make space. * When you restart Splunk Enterprise, the cache resets and the timer starts over. * This setting takes effect only when 'logCertificateData' has a value of 'true'. * A value of "0" means that the platform logs certificate data every time it receives a certificate. * Default: 1d sslCommonNameToCheck = * Checks the common name of the client certificate against this list of names. * If there is no match, assumes that the Splunk instance is not authenticated against this server. * For this setting to work, you must also set 'requireClientCert' to "true". * This setting is optional. * Default: empty string (no common name checking) sslAltNameToCheck = * Checks the alternate name of the client certificate against this list of names. * If there is no match, assumes that the Splunk instance is not authenticated against this server. * For this setting to work, you must also set 'requireClientCert' to "true". * This setting is optional. * Default: empty string (no alternate name checking) useSSLCompression = * Whether or not the server lets forwarders that connect to it negotiate SSL- layer data compression. * A value of "true" means the server lets forwarders negotiate SSL-layer data compression. * Default: The value of 'server.conf/[sslConfig]/allowSslCompression' sslServerHandshakeTimeout = * The timeout, in seconds, for an SSL handshake to complete between forwarder and the TCP input processor. * If the TCP input processor does not receive a "Client Hello" from the forwarder within 'sslServerHandshakeTimeout' seconds, the server terminates the connection. * Default: 60 ############################################################################ # UDP (User Datagram Protocol network input): ############################################################################ [udp://:] * Similar to the [tcp://] stanza, except that this stanza causes the Splunk instance to listen on a UDP port. * Only 1 stanza per port number is currently supported. * Configures the instance to listen on a specific port. * If you specify , the specified port only accepts data from that host. * If is empty - [udp://] - the port accepts data sent from any host. * The use of is not recommended. Use the 'acceptFrom' setting, which supersedes this setting. * Generates events with source set to udp:portnumber, for example: udp:514 * If you do not specify a sourcetype, generates events with sourcetype set to udp:portnumber. # Additional settings: connection_host = [ip|dns|none] * "ip" sets the host to the IP address of the system sending the data. * "dns" sets the host to the reverse DNS entry for IP address of the system that sends the data. For this to work correctly, set the forward DNS lookup to match the reverse DNS lookup in your DNS configuration. * "none" leaves the host as specified in inputs.conf, typically the Splunk system hostname. * If the input is configured with a 'sourcetype' that has a transform that overrides the 'host' field e.g. 'sourcetype=syslog', that takes precedence over the host specified here. * Default: ip _rcvbuf = * The receive buffer, in bytes, for the UDP port. * If you set the value to 0 or a negative number, the input ignores the value. * If the default value is too large for an OS, the instance tries to set the value to 1572864/2. If that value is also too large, the instance retries with 1572864/(2*2). It continues to retry by halving the value until it succeeds. * Default: 1572864 no_priority_stripping = * Whether or not the input strips syslog fields from events it receives over the syslog input. * A value of "true" means the instance does NOT strip the syslog field from received events. * NOTE: Do NOT set this setting if you want to strip . * Default: false no_appending_timestamp = * Whether or not to append a timestamp and host to received events. * A value of "true" means the instance does NOT append a timestamp and host to received events. * NOTE: Do NOT set this setting if you want to append timestamp and host to received events. * Default: false queueSize = [KB|MB|GB] * The maximum size of the in-memory input queue. * Default: 500KB persistentQueueSize = [KB|MB|GB|TB] * The maximum size of the persistent queue file. * Persistent queues can help prevent loss of transient data. For information on persistent queues and how the 'queueSize' and 'persistentQueueSize' settings interact, search the online documentation for "persistent queues".. * If you set this to a value other than 0, then 'persistentQueueSize' must be larger than either the in-memory queue size (as defined by the 'queueSize' setting in inputs.conf or 'maxSize' settings in [queue] stanzas in server.conf). * Default: 0 (no persistent queue) listenOnIPv6 = [no|yes|only] * Select whether the instance listens on the IPv4, IPv6, or both protocols. * Set this to 'yes' to listen on both IPv4 and IPv6 protocols. * Set to 'only' to listen on only the IPv6 protocol. * If not present, the input uses the setting in the [general] stanza of server.conf. acceptFrom = * See the description for this setting in the [tcp://:] stanza. * Default: "*" (accept from anywhere) [udp:] * This input stanza is the same as [udp://:], but does not have a restriction. * See the documentation for [udp://:] to configure supported settings: connection_host = [ip|dns|none] _rcvbuf = no_priority_stripping = no_appending_timestamp = queueSize = [KB|MB|GB] persistentQueueSize = [KB|MB|GB|TB] listenOnIPv6 = acceptFrom = ############################################################################ # FIFO (First In, First Out queue): ############################################################################ [fifo://] * This stanza configures the monitoring of a FIFO at the specified path. queueSize = [KB|MB|GB] * Maximum size of the in-memory input queue. * Default: 500KB persistentQueueSize = [KB|MB|GB|TB] * Maximum size of the persistent queue file. * Persistent queues can help prevent loss of transient data. For information on persistent queues and how the 'queueSize' and 'persistentQueueSize' settings interact, search the online documentation for "persistent queues".. * If you set this to a value other than 0, then 'persistentQueueSize' must be larger than either the in-memory queue size (as defined by the 'queueSize' setting in inputs.conf or 'maxSize' settings in [queue] stanzas in server.conf). * Default: 0 (no persistent queue) ############################################################################ # Scripted Input: ############################################################################ [script://] * Runs at a configured interval and indexes the output that returns. * To determine the interval at which the input runs , use the 'interval' setting. * The must reside in one of the following directories: * $SPLUNK_HOME/etc/system/bin/ * $SPLUNK_HOME/etc/apps/$/bin/ * $SPLUNK_HOME/bin/scripts/ * The path to can be an absolute path, make use of an environment variable such as $SPLUNK_HOME, or use the special pattern of an initial '.' as the first directory to indicate a location inside the current app. For more scripted input examples, search the documentation for "Add a scripted input with inputs.conf." * can also be a path to a file that ends with a ".path" suffix. A file with this suffix is a special type of pointer file that points to a command to be run. Although the pointer file is bound by the same location restrictions mentioned previously, the command referenced inside it can reside anywhere on the file system. The .path file must contain exactly one line: the path to the command to run, optionally followed by command-line arguments. The file can contain additional empty lines and lines that begin with '#'. The input ignores these lines. interval = [|] * How often, in seconds, to run the specified command, or a valid "cron" schedule. * If you specify the interval as a number, it may have a fractional component; for example, 3.14 * To specify a cron schedule, use the following format: * " " * Cron special characters are acceptable. You can use combinations of "*", ",", "/", and "-" to specify wildcards, separate values, specify ranges of values, and step values. * The cron implementation for data inputs does not currently support names of months or days. * The special value "0" forces this scripted input to be run continuously. As soon as the script exits, the input restarts it. * The special value "-1" causes the scripted input to run once on start-up. * NOTE: when you specify a cron schedule, the input does not run the script on start-up. * Default: 60.0 passAuth = * The user to run the script as. * If you provide a username, the instance generates an auth token for that user and passes it to the script through the stdin data stream. * No default. python.version = [default|python|python2|python3|python3.7|python3.9|latest] * For Python scripts only, selects which Python version to use. * Set to either "default" or "python" to use the system-wide default Python version. * Set to "python3" or "python3.7" to use the Python 3.7 version. * Set to "python3.9" to use the Python 3.9 version. * In the context of configuring apps, the "latest" value is not currently supported. It is related to a feature that is still under development. * Optional. * Default: Not set; uses the system-wide Python version. queueSize = [KB|MB|GB] * Maximum size of the in-memory input queue. * Default: 500KB persistentQueueSize = [KB|MB|GB|TB] * Maximum size of the persistent queue file. * Persistent queues can help prevent loss of transient data. For information on persistent queues and how the 'queueSize' and 'persistentQueueSize' settings interact, search the online documentation for "persistent queues".. * If you set this to a value other than 0, then 'persistentQueueSize' must be larger than either the in-memory queue size (as defined by the 'queueSize' setting in inputs.conf or 'maxSize' settings in [queue] stanzas in server.conf). * Default: 0 (no persistent queue) index = * The index where the scripted input sends the data. * The script passes this parameter as a command-line argument to in the format: -index . If the script does not need the index info, it can ignore this argument. * If you do not specify an index, the script uses the default index. send_index_as_argument_for_path = * Whether or not to pass the index as an argument when specified for stanzas that begin with 'script://' * A value of "true" means the script passes the argument as '-index '. * To avoid passing the index as a command line argument, set this to "false". * Default: true start_by_shell = * Whether or not to run the specified command through the operating system shell or command prompt. * A value of "true" means the host operating system runs the specified command through the OS shell ("/bin/sh -c" on *NIX, "cmd.exe /c" on Windows.) * A value of "false" means the input runs the program directly without attempting to expand shell metacharacters. * You might want to explicitly set a value of "false" for scripts that you know do not need UNIX shell metacharacter expansion. This is a Splunk best practice. * Default (on *nix machines): true * Default (on Windows machines): false ############################################################################ # File system change monitor (fschange monitor) ############################################################################ # # The file system change monitor has been deprecated as of Splunk Enterprise # version 5.0 and might be removed in a future version of the product. # # You cannot simultaneously monitor a directory with both the 'fschange' # and 'monitor' stanza types. # [fschange:] * Monitors changes (such as additions, updates, and deletions) to this directory and any of its sub-directories. * is the direct path. Do not preface it with '//' like with other inputs. * Sends an event for every change. disabled = * Whether or not the file system change monitor input is active. * Set a value of "true" to disable the input, and "false" to enable it. * Default: false # Additional settings: # NOTE: The 'fschange' stanza type does not use the same settings as # other input types. It uses only the following settings: index = * The index where the input sends the data. * Default: (if you either do not set 'signedaudit' or set 'signedaudit' to "false"): _audit * Default: (in all other cases): the default index signedaudit = * Whether or not to send cryptographically signed add/update/delete events. * A value of "true" means the input does the following to events that it generates: * Puts the events in the _audit index. * Sets the event sourcetype to 'audittrail' * A value of "false" means the input: * Places events in the default index. * Sets the sourcetype to whatever you specify (or "fs_notification" by default). * You must set 'signedaudit' to "false" if you want to set the index for fschange events. * You must also enable auditing by using the audit.conf file. * Default: false filters = * The fschange input applies each filter, left to right, for each file or directory found during the monitor poll cycle. * See the "File System Monitoring Filters" section later in this file for help on how to define a fschange filter. recurse = * Whether or not the fschange input should look through all sub-directories for changes to files in a directory. * A value of "true" means the input searches recursively through sub-directories within the directory specified in [fschange]. * Default: true followLinks = * Whether or not the fschange input follows any symbolic links it encounters. * A value of "true" means the input follows symbolic links. * CAUTION: Do not set this setting to "true" unless you can confirm that doing so will not create a file system loop (For example, in Directory A, symbolic link B points back to Directory A.) * Default: false pollPeriod = * How often, in seconds, to check a directory for changes. * Default: 3600 (1 hour) hashMaxSize = * The maximum size, in bytes, that a file can be for the fschange input to calculate a SHA256 hash for that file. * Tells the fschange input to calculate a SHA256 hash for every file that is this size or smaller, in bytes. * The input uses this hash as an additional method for detecting changes to the file or directory. * Default: -1 (disabled) fullEvent = * Whether or not to send the full event if the input detects an add or update change. * Set to "true" to send the full event if an add or update change is detected. * Further qualified by the 'sendEventMaxSize' setting. * Default: false sendEventMaxSize = * The maximum size, in bytes, that an fschange event can be for the input to send the full event to be indexed. * Limits the size of event data that the fschange input sends. * This also limits the size of indexed file data. * Default: -1 (unlimited) sourcetype = * Sets the source type for events from this input. * The input automatically prepends "sourcetype=" to . * Default (if you set the 'signedaudit' setting to "true"): audittrail * Default (if you set the 'signedaudit' setting to "false"): fs_notification host = * Sets the host name for events from this input. * Default: whatever host sent the event filesPerDelay = * The number of files that the fschange input processes between processing delays, as specified by the 'delayInMills' setting. * After a delay of 'delayInMills' milliseconds, the fschange input processes 'filesPerDelay' files, then waits 'delayInMills' milliseconds again before repeating this process. * This setting helps throttle file system monitoring so it consumes less CPU. * Default: 10 delayInMills = * The delay, in milliseconds, that the fschange input waits between processing 'filesPerDelay' files. * After a delay of 'delayInMills' milliseconds, the fschange input processes 'filesPerDelay' files, then waits 'delayInMills' milliseconds again before repeating this process. * This setting helps throttle file system monitoring so it consumes less CPU. * Default: 100 ############################################################################ # File system monitoring filters: ############################################################################ [filter::] * Defines a filter of type and names it . * : * Filter types are either 'blacklist' or 'whitelist.' 'blacklist' is the deny list filter type and 'whitelist' is the allow list filter type. * An allow list filter processes all file names that match the regular expression list that you define within the stanza. * A deny list filter skips all file names that match the regular expression list. * * The fschange input uses filter names that you specify with the 'filters' setting for a given fschange stanza. * You can specify multiple filters by separating them with commas. regex = * Deny list and allow list filters can include a set of regular expressions. * The name of each regular expression MUST be 'regex', meaning the string "regex" and then an integer. starts at 1 and increments by 1. * The input applies each regular expression in numeric order: regex1= regex2= ... ############################################################################ # http: (HTTP Event Collector) ############################################################################ # Global settings for the HTTP Event Collector (HEC) Input. [http] port = * The event collector data endpoint server port. * Default: 8088 disabled = * Whether or not the event collector input is active. * Give this setting a value of "1" to disable the input, and "0" to enable it. * Default: 1 (disabled) outputgroup = * The name of the output group to which the event collector forwards data. * There is no support for using this setting to send data over HTTP with a heavy forwarder. * Default: empty string useDeploymentServer = * Whether or not the HTTP event collector input writes its configuration to a deployment server repository. * When you enable this setting, the input writes its configuration to the directory that you specify with the 'repositoryLocation' setting in the serverclass.conf file. * You must copy the full contents of the splunk_httpinput app directory to this directory for the configuration to work. * When enabled, only the tokens defined in the splunk_httpinput app in this repository are viewable and editable through the API and Splunk Web. * When disabled, the input writes its configuration to $SPLUNK_HOME/etc/apps by default. * Default: 0 (disabled) index = * The default index to use. * Default: the "default" index sourcetype = * The default source type for the events that the input generates. * If you do not specify a sourcetype, the input does not set a sourcetype for events it generates. enableSSL = * Whether or not the HTTP Event Collector uses SSL. * HEC shares SSL settings with the Splunk management server and cannot have SSL enabled when the Splunk management server has SSL disabled. * Default: 1 (enabled) dedicatedIoThreads = * The number of dedicated input/output threads in the event collector input. * Default: 0 (The input uses a single thread) replyHeader. = * Adds a static header to all HTTP responses that this server generates. * For example, "replyHeader.My-Header = value" causes the response header "My-Header: value" to be included in the reply to every HTTP request made to the event collector endpoint server. * No default. maxSockets = * The number of HTTP connections that the HTTP event collector input accepts simultaneously. * Set this setting to constrain resource usage. * If you set this setting to 0, the input automatically sets it to one third of the maximum allowable open files on the host. * If this value is less than 50, the input sets it to 50. If this value is greater than 400000, the input sets it to 400000. * If set to a negative value, the input does not enforce a limit on connections. * Default: 0 maxThreads = * The number of threads that can be used by active HTTP transactions. * Set this to constrain resource usage. * If you set this setting to 0, the input automatically sets the limit to one third of the maximum allowable threads on the host. * If this value is less than 20, the input sets it to 20. If this value is greater than 150000, the input sets it to 150000. * If the 'maxSockets' setting has a positive value and 'maxThreads' is greater than 'maxSockets', then the input sets 'maxThreads' to be equal to 'maxSockets'. * If set to a negative value, the input does not enforce a limit on threads. * Default: 0 rollingRestartReturnServerBusy = * Whether or not HTTP Event Collector endpoints return HTTP errors 404 (not found) or 503 (server busy) when a client connects to an indexer that is currently shutting down during a rolling restart. * This setting applies to instances on the Classic Experience only. * NOTE: Do not change this setting unless instructed to do so by Splunk Support. * Default: true keepAliveIdleTimeout = * How long, in seconds, that the HTTP Event Collector input lets a keep-alive connection remain idle before forcibly disconnecting it. * If this value is less than 7200, the input sets it to 7200. * Default: 7200 busyKeepAliveIdleTimeout = * How long, in seconds, that the HTTP Event Collector lets a keep-alive connection remain idle while in a busy state before forcibly disconnecting it. * CAUTION: Setting this to a value that is too large can result in file descriptor exhaustion due to idling connections. * If this value is less than 12, the input sets it to 12. * Default: 12 serverCert = * The full path to the server certificate PEM format file. * The same file may also contain a private key. * Splunk software automatically generates certificates when it first starts. * You may replace the auto-generated certificate with your own certificate. * Default: $SPLUNK_HOME/etc/auth/server.pem sslKeysfile = * DEPRECATED. * Use the 'serverCert' setting instead. * The file that contains the SSL keys. Splunk software looks for this file in the directory specified by 'caPath'. * Default: server.pem sslPassword = * The server certificate password. * Initially set to a plain-text password. * Upon first use, Splunk software encrypts and rewrites the password. * Default: password sslKeysfilePassword = * DEPRECATED. * Use the 'sslPassword' setting instead. caCertFile = * DEPRECATED. * Use the 'server.conf:[sslConfig]/sslRootCAPath' setting instead. * Used only if you do not set the 'sslRootCAPath' setting. * Specifies the file name (relative to 'caPath') of the CA (Certificate Authority) certificate PEM format file that contains one or more certificates concatenated together. * Default: cacert.pem caPath = * DEPRECATED. * Use absolute paths for all certificate files. * If certificate files given by other settings in this stanza are not absolute paths, then they are relative to this path. * Default: $SPLUNK_HOME/etc/auth sslVersions = * A comma-separated list of SSL versions to support. * The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2" * The special version "*" selects all supported versions. The version "tls" selects all versions "tls1.0" or newer. * To remove a version from the list, prefix it with "-". * SSLv2 is always disabled. Specifying "-ssl2" in the version list has no effect. * When configured in Federal Information Processing Standard (FIPS) mode, the "ssl3" version is always disabled, regardless of this configuration. * Default: *,-ssl2 (anything newer than SSLv2) cipherSuite = * The cipher string to use for the HTTP Event Collector input. * Use this setting to ensure that the server does not accept connections using weak encryption protocols. * If you set this setting, the input uses the specified cipher string for the HTTP server. * Default: The default cipher string that 'OpenSSL' provides sslServerHandshakeTimeout = * The timeout, in seconds, for an SSL handshake to complete between an HEC client and the Splunk HEC server. * If the HEC server does not receive a "Client Hello" from the HEC client within 'sslServerHandshakeTimeout' seconds, the server terminates the connection. * Default: 60 listenOnIPv6 = [no|yes|only] * Whether or not this input listens on IPv4, IPv6, or both. * Set to "no" to make the input listen only on the IPv4 protocol. * Set to "yes" to make the input listen on both IPv4 and IPv6 protocols. * Set to "only" to make the input listen on only the IPv6 protocol. * Default: The setting in the [general] stanza of the server.conf file acceptFrom = * See the description for this setting in the [tcp://:] stanza. * Default: "*" (accept from anywhere) requireClientCert = * Requires that any client connecting to the HEC port has a certificate that can be validated by the certificate authority specified in the 'caCertFile' setting. * Default: false ecdhCurveName = * DEPRECATED. * Use the 'ecdhCurves' setting instead. * This setting specifies the ECDH curve to use for ECDH key negotiation. * Splunk software only supports named curves that have been specified by their SHORT names. * The list of valid named curves by their short or long names can be obtained by executing this command: $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves * Default: empty string ecdhCurves = * ECDH curves to use for ECDH key negotiation. * The curves should be specified in the order of preference. * The client sends these curves as a part of Client Hello. * The server supports only the curves specified in the list. * Splunk software only supports named curves that have been specified by their SHORT names. * The list of valid named curves by their short or long names can be obtained by executing this command: $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves * Example setting: ecdhCurves = prime256v1,secp384r1,secp521r1 * Default: empty string crossOriginSharingPolicy = ... * A list of the HTTP Origins for which to return Access-Control-Allow-* Cross-origin Resource Sharing (CORS) headers. * These headers tell browsers that web applications at those sites can be trusted to make requests to the REST interface. * The origin is passed as a URL without a path component (for example "https://app.example.com:8000"). * This setting can take a list of acceptable origins, separated by spaces and/or commas. * Each origin can also contain wildcards for any part. Examples: * *://app.example.com:* (either HTTP or HTTPS on any port) * https://*.example.com (any host under example.com, including example.com itself). * An address can be prefixed with a '!' to negate the match, with the first matching origin taking precedence. Example: * "!*://evil.example.com:* *://*.example.com:*" to not avoid matching one host in a domain. * "*" matches all origins. * Default: empty string crossOriginSharingHeaders = * A list of the HTTP headers to which splunkd sets "Access-Control-Allow-Headers" when replying to Cross-Origin Resource Sharing (CORS) preflight requests. * The "Access-Control-Allow-Headers" header is used in response to a CORS preflight request to tell browsers which HTTP headers can be used during the actual request. * A CORS preflight request is a CORS request that checks to see if the CORS protocol is understood and a server is aware of using specific methods and headers. * This setting can take a list of acceptable HTTP headers, separated by commas. * A single "*" can also be used to match all headers. * Default: empty string forceHttp10 = [auto|never|always] * Whether or not the REST HTTP server forces clients that connect to it to use the HTTP 1.0 specification for web communications. * When set to "always", the REST HTTP server does not use some HTTP 1.1 features such as persistent connections or chunked transfer encoding. * When set to "auto", it does this only if the client did not send a User-Agent header, or if the user agent is known to have bugs in its support of HTTP/1.1. * When set to "never" it always allows HTTP 1.1, even to clients it suspects might be buggy. * Default: auto sslCommonNameToCheck = * A list of SSL Common Names to match against certificates that incoming HTTPS connections present to this instance. * If you configure this setting and also set 'requireClientCert' to "true", splunkd limits most inbound HTTPS connections to hosts that use a cert with one of the listed common names. * The most important scenario to use this setting is distributed search. * This feature does not work with the deployment server and client communication over SSL. * This setting is optional. * Default: empty string (no common name checking) sslAltNameToCheck = * If you set this setting and also set 'requireClientCert' to true, splunkd can verify certificates that have a so-called "Subject Alternate Name" that matches any of the alternate names in this list. * Subject Alternate Names are effectively extended descriptive fields in SSL certs beyond the commonName. A common practice for HTTPS certs is to use these values to store additional valid hostnames or domains where the cert should be considered valid. * Accepts a comma-separated list of Subject Alternate Names to consider valid. * Items in this list are never validated against the SSL Common Name. * This feature does not work with the deployment server and client communication over SSL. * This setting is optional. * Default: empty string (no alternate name checking) sendStrictTransportSecurityHeader = * Whether or not to force inbound connections to always use SSL with the "Strict-Transport-Security" header.. * If set to "true", the REST interface sends a "Strict-Transport-Security" header with all responses to requests made over SSL. * This can help prevent a client being tricked later by a Man-In-The-Middle attack to accept a non-SSL request. However, this requires a commitment that no non-SSL web hosts will ever be run on this hostname on any port. For example, if Splunk Web is in default non-SSL mode this can break the ability of the browser to connect to it. Enable with caution. * Default: false allowSslCompression = * Whether or not to allow data compression over SSL. * If set to "true", the server allows clients to negotiate SSL-layer data compression. * Default: true allowSslRenegotiation = * Whether or not to let SSL clients renegotiate their connections. * In the SSL protocol, a client may request renegotiation of the connection settings from time to time. * Setting this to false causes the server to reject all renegotiation attempts, which breaks the connection. * This limits the amount of CPU a single TCP connection can use, but it can cause connectivity problems, especially for long-lived connections. * Default: true ackIdleCleanup = * Whether or not to remove ACK channels that have been idle after a period of time, as defined by the 'maxIdleTime' setting. * A value of "true" means the server removes the ACK channels that are idle for 'maxIdleTime' seconds. * Default: true maxIdleTime = * The maximum amount of time, in seconds, that ACK channels can be idle before they are removed. * If 'ackIdleCleanup' is "true", the system removes ACK channels that have been idle for 'maxIdleTime' seconds. * Default: 600 (10 minutes) channel_cookie = * The name of the cookie to use when sending data with a specified channel ID. * The value of the cookie is the channel sent. For example, if you have set 'channel_cookie=foo' and sent a request with channel ID set to 'bar', then you will have a cookie in the response with the value 'foo=bar'. * If no channel ID is present in the request, then no cookie is returned. * This setting is to be used for load balancers (for example, AWS ELB) that can only provide sticky sessions on cookie values and not general header values. * If no value is set (the default), then no cookie is returned. * Default: empty string (no cookie) maxEventSize = [KB|MB|GB] * The maximum size of a single HEC (HTTP Event Collector) event. * HEC disregards and triggers a parsing error for events whose size is greater than 'maxEventSize'. * Default: 5MB route = [has_key|absent_key::;...] * See 'route' in the "[splunktcp]" stanza for information on this setting. ############################################################################ # HTTP Event Collector (HEC) - Local stanza for each token ############################################################################ [http://name] token = * The value of the HEC token. * HEC uses this token to authenticate inbound connections. Your application or web client must present this token when attempting to connect to HEC. * No default. disabled = * Whether or not this token is active. * Default: 0 (enabled) description = * A human-readable description of this token. * Default: empty string indexes = * The indexes that events for this token can go to. * If you do not specify this value, the index list is empty, and any index can be used. * Separate multiple indexes with commas. * The Splunk platform accepts and indexes events without a specified index to a default index. * No default. s2s_indexes_validation = [ disabled | disabled_for_internal | enabled_for_all ] * The method of index validation for Splunk-to-Splunk (S2S) events for this token. * A value of "disabled" means the Splunk platform doesn't validate the event's index and the "indexes" setting has no effect for the S2S events. * A value of "disabled_for_internal" means the Splunk platform doesn't validate internal indexes and allows all S2S events destined for them. The platform validates other indexes according to the "indexes" setting. * A value of "enabled_for_all" means the platform validates all indexes according to the "indexes" setting. * The platform silently drops rejected events. * Default: disabled_for_internal index = * The default index to use for this token. * Default: the default index sourcetype = * The default sourcetype to use if it is not specified in an event. * Default: empty string outputgroup = * The name of the forwarding output group to send data to. * There is no support for using this setting to send data over HTTP with a heavy forwarder. * Default: empty string queueSize = [KB|MB|GB] * The maximum size of the in-memory input queue. * Default: 500KB persistentQueueSize = [KB|MB|GB|TB] * Maximum size of the persistent queue file. * Persistent queues can help prevent loss of transient data. For information on persistent queues and how the 'queueSize' and 'persistentQueueSize' settings interact, search the online documentation for "persistent queues".. * If you set this to a value other than 0, then 'persistentQueueSize' must be larger than either the in-memory queue size (as defined by the 'queueSize' setting in inputs.conf or 'maxSize' settings in [queue] stanzas in server.conf). * Default: 0 (no persistent queue) connection_host = [ip|dns|proxied_ip|none] * Specifies the host if an event doesn't have a host set. * "ip" sets the host to the IP address of the system sending the data. * "dns" sets the host to the reverse DNS entry for IP address of the system that sends the data. For this to work correctly, set the forward DNS lookup to match the reverse DNS lookup in your DNS configuration. * "proxied_ip" checks whether an X-Forwarded-For header was sent (presumably by a proxy server) and if so, sets the host to that value. Otherwise, the IP address of the system sending the data is used. * "none" leaves the host as specified in the HTTP header. * No default. useACK = * When set to "true", acknowledgment (ACK) is enabled. Events in a request are tracked until they are indexed. An events status (indexed or not) can be queried from the ACK endpoint with the ID for the request. * When set to false, acknowledgment is not enabled. * This setting can be set at the stanza level. * Default: false allowQueryStringAuth = * Enables or disables sending authorization tokens with a query string. * This is a token level configuration. It may only be set for a particular token. * To use this feature, set to "true" and configure the client application to include the token in the query string portion of the URL they use to send data to HEC in the following format: "https://?&token=" or "https://?token=" if the token is the first element in the query string. * If a token is sent in both the query string and an HTTP header, the token in the query string takes precedence, even if this feature is disabled. In other words, if a token is present in the query string, any token in the header for that request is not used. * NOTE: Query strings may be observed in transit and/or logged in cleartext. There is no confidentiality protection for the transmitted tokens. * Before using this in production, consult security personnel in your organization to understand and plan to mitigate the risks. * At a minimum, always use HTTPS when you enable this feature. Check your client application, proxy, and logging configurations to confirm that the token is not logged in clear text. * Give minimal access permissions to the token in HEC and restrict the use of the token only to trusted client applications. * Default: false ############################################################################ # WINDOWS INPUTS: ############################################################################* * Windows platform specific input processor. # *********** # Splunk software on Windows ships with several Windows-only inputs. They are # defined in the default inputs.conf. * Use the "disabled=" setting to enable/disable any of them. * A short summary of the inputs follows: * Perfmon: Monitors Windows performance counters, objects, and instances. * WinRegMon: Tracks and report any changes that occur in the local system Registry. * ADMon: Indexes existing Active Directory (AD) objects and listens for AD changes. * WMI: Retrieves event logs remotely and locally through the Windows Management Instrumentation subsystem. It can also gather performance data remotely, as well as receive various system notifications. See wmi.conf.spec for information on how to configure this input. #******* # The following Windows input specifications are for parsing on non-Windows # platforms. #******* ############################################################################ # Performance Monitor ############################################################################ [perfmon://] * This section explains possible settings for configuring the Windows Performance Monitor input. * Each perfmon:// stanza represents an individually configured performance monitoring input. If you configure the input through Splunk Web, then the value of "" matches what was specified there. While you can add performance monitor inputs manually, it is a best practice to use Splunk Web to configure them, because it is easy to mistype the values for Performance Monitor objects, counters, and instances. * NOTE: The perfmon stanza is for local systems ONLY. To define performance monitor inputs for remote machines, use wmi.conf. object = * A valid Performance Monitor object as defined within Performance Monitor (for example, "Process," "Server," "PhysicalDisk"). * You can specify a single valid Performance Monitor object or use a regular expression (regex) to specify multiple objects. * This setting is required, and the input does not run if the setting is not present. * No default. counters = * This can be a single counter, or multiple valid Performance Monitor counters. * This setting is required, and the input does not run if the setting is not present. * "*" is equivalent to all available counters for a given Performance Monitor object. * No default. nonmetric_counters = * A list of performance counters on which the performance monitor input must not perform sampling. * When the input retrieves the value for a counter that is in this list, it returns the latest value it retrieves, rather than an average of the values that it got over the sampling interval, as defined by the 'samplingInterval' setting. * Add counters to this setting in cases where the values that the input returns for a setting would be incorrect if it were averaged over a 'samplingInterval', or where average, minimum, or maximum values for a counter would not be of any interest. * As an example, the "ID Process" counter works better as a non metric counter because the most recent measurement of the counter is more relevant than the average of any measurements of that counter. * No default. instances = * One or more multiple valid Performance Monitor instances. * "*" is equivalent to all available instances for a given Performance Monitor counter. * If applicable instances are available for a counter and this setting is not present, then the input logs data for all available instances (this is the same as setting "instances = *"). * If there are no applicable instances for a counter, then you can omit this setting. * No default. interval = * How often, in seconds, to poll for new data. * This setting is required, and the input does not run if the setting is not present. * The recommended setting depends on the Performance Monitor object, counter(s), and instance(s) that you define in the input, and how much performance data you need. * Objects with numerous instantaneous or per-second counters, such as "Memory", "Processor", and "PhysicalDisk" should have shorter interval times specified (anywhere from 1-3 seconds). * Less volatile counters such as "Terminal Services", "Paging File", and "Print Queue" can have longer intervals configured. * Default: 300 mode = [single|multikv] * Specifies how the performance monitor input generates events. * Set to "single" to print each event individually. * Set to "multikv" to print events in multikv (formatted multiple key-value pair) format. * Default: single samplingInterval = * How often, in milliseconds, to poll for new data. * This is an advanced setting. * Enables high-frequency performance sampling. The input collects performance data every sampling interval. It then reports averaged data and other statistics at every interval. * The minimum legal value is 100, and the maximum legal value must be less than the 'interval' setting. * If not set, high-frequency sampling does not occur. * No default (disabled). stats = * Reports statistics for high-frequency performance sampling. * This is an advanced setting. * Setting a 'samplingInterval' is required to use 'stats'. * Acceptable values are: average, count, dev, min, max. * You can specify multiple values by separating them with semicolons. * Adds new fields that append the stats function name. Setting 'average' replaces the stats displayed in the default field. * No default. (disabled) disabled = * Specifies whether or not the input is enabled. * Set to 1 to disable the input, and 0 to enable it. * Default: 0 (enabled) showZeroValue = * Specifies whether or not the input collects zero-value event data. * Set to 1 to capture zero value event data, and 0 to ignore such data. * Default: 0 (ignore zero value event data) useEnglishOnly = * Controls which Windows Performance Monitor API the input uses. * If set to "true", the input uses PdhAddEnglishCounter() to add the counter string. This ensures that counters display in English regardless of the Windows machine locale. * If set to "false", the input uses PdhAddCounter() to add the counter string. * NOTE: if you set this setting to true, the 'object' setting does not accept a regular expression as a value on machines that have a non-English locale. * Default: false useWinApiProcStats = * Whether or not the Performance Monitor input uses process kernel mode and user mode times to calculate CPU usage for a process, rather than using the standard Performance Data Helper (PDH) APIs to calculate those values. * A problem was found in the PDH APIs that causes Performance Monitor inputs to show maximum values of 100% usage for a process on multicore Windows machines, even when the process uses more than 1 core at a time. * When you configure this setting to "true", the input uses the GetProcessTime() function in the core Windows API to calculate CPU usage for a process, for the following Performance Monitor counters, only: ** Processor Time ** User Time ** Privileged Time * This means that, if a process uses 5 of 8 cores on an 8-core machine, that the input should return a value of around 500, rather than the incorrect 100. * When you configure the setting to "false", the input uses the standard PDH APIs to calculate CPU usage for a process. On multicore systems, the maximum value that PDH APIs return is 100, regardless of the number of cores in the machine that the process uses. * Performance monitor inputs use the PDH APIs for all other Performance Monitor counters. Configuring this setting has no effect on those counters. * NOTE: If the Windows machine uses a non-English system locale, and you have set 'useWinApiProcStats' to "true" for a Performance Monitor input, then you must also set 'useEnglishOnly' to "true" for that input. * Default: false formatString = * Controls the print format for double-precision statistic counters. * Do not use quotes when specifying this string. * Default: %.20g usePDHFmtNoCap100 = * Whether or not performance counter values that are greater than 100 (for example, counter values that measure the processor load on computers with multiple processors) are reset to 100. * If set to "true", the counter values can exceed 100. * If set to "false", the input resets counter values to 100 if the processor load on multiprocessor computers exceeds 100. * Default: false ############################################################################ # Direct Access File Monitor ############################################################################ # For Windows systems only. # Does not use file handles [MonitorNoHandle://] * This input intercepts file writes to the specific file. * must be a fully qualified path name to a specific file. Wildcards and directories are not accepted. * This input type does not function on *nix machines. * You can specify more than one stanza of this type. disabled = * Whether or not the input is enabled. * Default: 0 (enabled) index = * Specifies the index where this input sends the data. * This setting is optional. * Default: the default index ############################################################################ # Windows Event Log Monitor ############################################################################ [WinEventLog://] * This section explains possible settings for configuring the Windows Event Log monitor. * Each WinEventLog:// stanza represents an individually configured WinEventLog monitoring input. If you you configure the input through Splunk Web, the value of "" matches what was specified there. While you can add event log monitor inputs manually, it is best practice to use Splunk Web to configure Windows event log monitor inputs because it is easy to mistype the values for event log channels. * NOTE: The WinEventLog stanza is for local systems ONLY. To define event log monitor inputs for remote machines, use wmi.conf. start_from = * How the Event Log input is to chronologically read the Event Log channels. * A value of "oldest" means that the input reads Windows event logs from the oldest to the most recent. * A value of "newest" means that the input reads Windows event logs in reverse, from the most recent to the oldest. After the input consumes the backlog of events, it stops. * If you set this setting to "newest", and at the same time give the 'current_only' setting a value of "false", the combination can result in the input indexing duplicate events. * Do not set this setting to "newest" and at the same time give the 'current_only' setting a value of "true". This results in the input not collecting any events because you told it to read existing events from newest to oldest and read only incoming events concurrently, which is a logically impossible combination. * Default: oldest use_old_eventlog_api = * Whether or not to read Event Log events with the Event Logging API. * This is an advanced setting. Contact Splunk Support before you change it. * A value of "true" means the input uses the Event Logging API (instead of the Windows Event Log API) to read from the Event Log on Windows Server 2008, Windows Vista, and later installations. * Default: false (Use the API that is specific to the OS) use_threads = * Specifies the number of threads, in addition to the default writer thread, that can be created to filter events with the deny list/allow list regular expression. * This is an advanced setting. Contact Splunk Support before you change it. * The maximum number of threads is 15. * Default: 0 thread_wait_time_msec = * The interval, in milliseconds, between attempts to re-read Event Log files when a read error occurs. * This is an advanced setting. Contact Splunk Support before you change it. * Default: 5000 # # NOTE: The 'suppress_*' settings are similar to, but operate differently than, # the 'evt_exclude_fields' setting. The 'suppress_*' settings avoid using the # Windows API to gather Windows events that match the available # fields, which helps with CPU performance. The 'evt_exclude_fields' # is valid for all Windows Event Log fields, and while it does use # the Windows API for all transactions, it discards the fields in # each event that match, which helps reduce total data ingestion. # suppress_checkpoint = * Whether or not the Event Log strictly follows the 'checkpointInterval' setting when it saves a checkpoint. * This is an advanced setting. Contact Splunk Support before you change it. * By default, the Event Log input saves a checkpoint from between zero and 'checkpointInterval' seconds, depending on incoming event volume. If you set this setting to "true", that does not happen. * Default: false suppress_sourcename = * Whether or not to exclude the 'sourcename' field from events. * This is an advanced setting. Contact Splunk Support before you change it. * When set to true, the input excludes the 'sourcename' field from events and thruput performance (the number of events processed per second) improves. * Default: false suppress_keywords = * Whether or not to exclude the 'keywords' field from events. * This is an advanced setting. Contact Splunk Support before you change it. * When set to true, the input excludes the 'keywords' field from events and thruput performance (the number of events processed per second) improves. * Default: false suppress_type = * Whether or not to exclude the 'type' field from events. * This is an advanced setting. Contact Splunk Support before you change it. * When set to true, the input excludes the 'type' field from events and thruput performance (the number of events processed per second) improves. * Default: false suppress_task = * Whether or not to exclude the 'task' field from events. * This is an advanced setting. Contact Splunk Support before you change it. * When set to true, the input excludes the 'task' field from events and thruput performance (the number of events processed per second) improves. * Default: false suppress_opcode = * Whether or not to exclude the 'opcode' field from events. When set to true, the input excludes the 'opcode' field from events and thruput performance (the number of events processed per second) improves. * This is an advanced setting. Contact Splunk Support before you change it. * Default: false current_only = * Whether or not to acquire only events that arrive while the instance is running. * A value of "true" means the input only acquires events that arrive while the instance runs and the input is on. The input does not read data which was stored in the Windows Event Log while the instance was not running. This means that there will be gaps in the data if you restart the instance or experiences downtime. * A value of "false" means the input first gets all existing events that are stored in the log which have higher event IDs (have arrived more recently) than the most recent events acquired. The input then monitors events that arrive in real time. * If you set this setting to "false", and at the same time set the 'start_from' setting to "newest", the combination can result in the indexing of duplicate events. * Do not set this setting to "true" and at the same time set the 'start_from' setting to "newest". This results in the input not collecting any events because you told it to read existing events from oldest to newest and read only incoming events concurrently, which is a logically impossible combination. * Default: false (Gather stored events with higher event IDs first before monitoring live events) batch_size = * How many Windows Event Log items to read per request. * If troubleshooting identifies that the Event Log input is a bottleneck in acquiring data, increasing this value can help. * NOTE: Splunk Support has seen cases where large values can result in a stall in the Event Log subsystem. If you increase this value significantly, monitor closely for trouble. * In local and customer acceptance testing, a value of 10 was acceptable for both throughput and reliability. * Default: 10 checkpointInterval = * How often, in seconds, that the Windows Event Log input saves a checkpoint. * Checkpoints store the eventID of acquired events. This lets the input continue monitoring at the correct event after a shutdown or outage. * Default: 0 checkpointSync = * Determines whether the input processor forces writing a checkpoint file to disk immediately or lets the operating system handle when writing of the file to disk occurs. * A value of "true" means the input processor triggers writing of a checkpoint file to disk immediately. It also saves the file to a temporary location and renames it instead of overwriting the existing file. * Default: false channel_wait_time = * How long, in seconds, that the Windows Event Log input waits for an Event Log channel that is not available to become available again. * Some Event Log channels, like the Windows Defender channel, become unavailable during a Windows Defender Platform update and it takes some time to become available again. * If the Event Log input is unable to collect event logs from a certain Event Log channel, change this setting to an appropriate value. For example, if the input does not collect Windows Defender event logs after a Windows Defender Platform update, increase this value. * The maximum wait time is 180 (3 minutes). * Default: 0 disabled = * Whether or not the input is enabled. * Set to 1 to disable the input, and 0 to enable it. * Default: 0 (enabled) evt_resolve_ad_obj = * How the input should interact with Active Directory while indexing Windows Event Log events. * If you set this setting to true, the input resolves the Active Directory Security IDentifier (SID) objects to their canonical names for a specific Windows Event Log channel. * If you enable the setting, the rate at which the input reads events on high-traffic Event Log channels can decrease. Latency can also increase during event acquisition. This is due to the overhead involved in performing AD translations. * When you set this setting to true, you can optionally specify the domain controller name or dns name of the domain to bind to with the 'evt_dc_name' setting. The input connects to that domain controller to resolve the AD objects. * If you set this setting to false, the input does not attempt any resolution. * Default: false (disabled) for all channels evt_skip_GUID_resolution = * A list of Windows Event Codes for which the Splunk platform does not contact the domain controller to resolve global unique identifiers (GUIDs) that are withing the event. * Separate multiple event IDs or event ID ranges with commas. * If the event code matches an event, The Splunk platform does not contact the DC to resolve any GUIDs in this event. * This setting only takes effect if 'evt_resolve_ad_obj' has a value of "true". * If 'evt_resolve_ad_obj' has a value of "false", this setting has no effect. * This setting has no effect on SID resolution. * See 'Event ID list format' later in this file for the proper formatting of the event list. * Default: none evt_dc_name = * Which Active Directory domain controller to bind to for AD object resolution. * If you prefix a dollar sign to a value (for example, $my_domain_controller), the input interprets the value as an environment variable. If the environment variable has not been defined on the host, it is the same as if the value is blank. * This setting is optional. * This setting can be set to the NetBIOS name of the domain controller or the fully-qualified DNS name of the domain controller. Either name type can, optionally, be preceded by two backslash characters. The following examples represent correctly formatted domain controller names: * "FTW-DC-01" * "\\FTW-DC-01" * "FTW-DC-01.splunk.com" * "\\FTW-DC-01.splunk.com" * $my_domain_controller evt_dns_name = * The fully-qualified DNS name of the domain that the input should bind to for AD object resolution. * This setting is optional. evt_resolve_ad_ds = [auto|PDC] * How the input should choose the domain controller to bind for AD resolution. * This setting is optional. * If set to PDC, the input only contacts the primary domain controller to resolve AD objects. * If set to auto, the input lets Windows chose the best domain controller. * If you set the 'evt_dc_name' setting, the input ignores this setting. * Default: auto (let Windows determine the domain controller to use) evt_ad_cache_disabled = * Enables or disables the AD object cache. * Default: false (enabled) evt_ad_cache_exp = * The expiration time, in seconds, for AD object cache entries. * This setting is optional. * Default: 3600 (1 hour) evt_ad_cache_exp_neg = * The expiration time, in seconds, for negative AD object cache entries. * This setting is optional. * Default: 10 evt_ad_cache_max_entries = * The maximum number of AD object cache entries. * This setting is optional. * Default: 1000 evt_exclude_fields = * A list of valid Windows Event Log fields to exclude from Windows Event Log events. * Specify fields that you want excluded from each event report. * Do not exclude fields that you have also added to allow lists or deny lists. If fields are present in both, then 'evt_exclude_fields' excludes those fields, regardless of their presence in the allow list or deny list and the allow list or deny list will not behave as expected. The input logs an error to splunkd.log in this case. * This setting is similar to, but operates differently than, the 'suppress_*' settings. The 'suppress_*' settings avoid using the Windows API to gather Windows events that match the available fields, which helps with CPU performance. The 'evt_exclude_fields' is valid for all Windows Event Log fields, and while it does use the Windows API for all transactions, it discards the fields in each event that match, which helps reduce total data ingestion. * Does not effect event report if 'renderXML' is set to "true". * The 'evt_exclude_fields' setting is valid for all Windows Event Log fields. * No default. evt_sid_cache_disabled = * Enables or disables account Security IDentifier (SID) cache. * This setting is global. It affects all Windows Event Log stanzas. * Default: 0 evt_sid_cache_exp = * The expiration time, in seconds, for account SID cache entries. * This setting is global. It affects all Windows Event Log stanzas. * This setting is optional. * Default: 3600 evt_sid_cache_exp_neg = * The expiration time, in seconds, for negative account SID cache entries. * This setting is optional. * This setting is global. It affects all Windows Event Log stanzas. * Default: 10 evt_sid_cache_max_entries = * The maximum number of account SID cache entries. * This setting is global. It affects all Windows Event Log stanzas. * This setting is optional. * Default: 10 wec_event_format = [raw_event|rendered_event] * The content format of the events that the Splunk platform expects to receive from a Windows Event Collector (WEC) subscription, before WEC sends the events to their destination log, for example, a Windows Event Log channel. * This setting helps associate incoming WEC event formats with the Splunk platform internal interpretation before the platform looks up pre-rendered messages in Windows event logs. * If the WEC subscription that targets this channel has its 'content Format' set to "Events", then set 'wec_event_format' to "raw_event". * If the WEC subscription that targets this channel has its 'content Format' set to "RenderedText", then set 'wec_event_format' to "rendered_event". * If multiple WEC subscriptions share the same value for the 'destination log' setting, but have different 'content Format' values, you have two options: * You can update the WEC subscriptions so that they share the same values for 'content format'. * Or you can create custom ForwardedEvents channels for each WEC subscription, point each WEC subscription to a custom ForwardedEvents channel, and set equivalent values for 'wec_event_format' as described previously. * If Windows Event Collector does not forward these events, this setting is optional. * NOTE: You must restart the Splunk platform when you update WEC subscriptions, to synchronize with the new subscription configuration. * Default (for 'ForwardedEvents' and custom channels named 'ForwardedEvents-1', 'ForwardedEvents-2', etc.): rendered_event * Default (for all other channels): raw_event index = * Specifies the index that this input should send the data to. * This setting is optional. * Default: The default index ############################################################################ # Event Log filtering ############################################################################ # Filtering at the input layer is desirable to reduce the total # processing load in network transfer and computation on the Splunk platform # nodes that acquire and processing Event Log data. whitelist = | key=regex [key=regex] blacklist = | key=regex [key=regex] whitelist1 = | key=regex [key=regex] whitelist2 = | key=regex [key=regex] whitelist3 = | key=regex [key=regex] whitelist4 = | key=regex [key=regex] whitelist5 = | key=regex [key=regex] whitelist6 = | key=regex [key=regex] whitelist7 = | key=regex [key=regex] whitelist8 = | key=regex [key=regex] whitelist9 = | key=regex [key=regex] blacklist1 = | key=regex [key=regex] blacklist2 = | key=regex [key=regex] blacklist3 = | key=regex [key=regex] blacklist4 = | key=regex [key=regex] blacklist5 = | key=regex [key=regex] blacklist6 = | key=regex [key=regex] blacklist7 = | key=regex [key=regex] blacklist8 = | key=regex [key=regex] blacklist9 = | key=regex [key=regex] * These settings are optional. * Both numbered and unnumbered allow lists and deny lists support two formats: * A comma-separated list of event IDs. * A list of key=regular expression pairs. * You cannot combine these formats. You can use either format on a specific line. * Numbered allow list settings are permitted from 1 to 9, so whitelist1 through whitelist9 and blacklist1 through blacklist9 are supported. * If no allow list or deny list rules are present, the input reads all events. ############################################################################ # Event Log allow list and deny list formats ############################################################################ * Event ID list format: * A comma-separated list of terms. * Terms may be a single event ID (e.g. 6) or range of event IDs (e.g. 100-200) * Example: 4,5,7,100-200 * This applies to events with IDs 4, 5, 7, or any event ID between 100 and 200, inclusive. * A single asterisk (*) means all event codes. * The event ID list format provides no additional functionality over the key=regex format, but can be easier to understand: List format: 4,5,7,100-200 Regex equivalent: EventCode=%^(4|5|7|1..|200)$% * key=regex format: * A whitespace-separated list of Event Log components to match, and regular expressions to match against against them. * There can be one match expression or multiple expressions per line. * The key must belong to the set of valid keys provided in the "Valid keys for the key=regex format" section. * The regex consists of a leading delimiter, the regex expression, and a trailing delimiter. Examples: %regex%, *regex*, "regex" * When multiple match expressions are present, they are treated as a logical AND. In other words, all expressions must match for the line to apply to the event. * If the value represented by the key does not exist, it is not considered a match, regardless of the regex. * Example: whitelist = EventCode=%^200$% User=%jrodman% Include events only if they have EventCode 200 and relate to User jrodman # Valid keys for the key=regex format: * The following keys are equivalent to the fields that appear in the text of the acquired events: * Category, CategoryString, ComputerName, EventCode, EventType, Keywords, LogName, Message, OpCode, RecordNumber, Sid, SidType, SourceName, TaskCategory, Type, User * There are three special keys that do not appear literally in the event. * $TimeGenerated: The time that the computer generated the event * $Timestamp: The time that the event was received and recorded by the Event Log service. * $XmlRegex: Use this key for filtering when you render Windows Event log events in XML by setting the 'renderXml' setting to "true". Search the Splunk platform Getting Data In Manual for "Filter data in XML format with the XmlRegex key" for details. * The 'EventType' key is only available on Windows Server 2003 / Windows XP and earlier. * The 'Type' key is only available on Windows Server 2008 / Windows Vista and later. * For a detailed definition of these keys, see the "Monitor Windows Event Log Data" topic in the online documentation. suppress_text = * Whether or not to include the description of the event text for a given Event Log event. * This setting is optional. * Set this setting to true to suppress the inclusion of the event text description. * Set this value to false to include the event text description. * Default: false renderXml = * Whether or not the input returns the event data in XML (eXtensible Markup Language) format or in plain text. * A value of "true" means that the input renders events in XML format. * A value of "false" means that the input renders events in plain text. * If you give this setting a value of "true", you should also give the 'suppress_text', 'suppress_sourcename', 'suppress_keywords', 'suppress_task', and 'suppress_opcode' settings a value of "true" to improve thruput performance. * A value of "true" also changes the method by which you create allow- and deny lists to filter events. For these kinds of lists to work, you must use the '$xmlRegex' special key and assign regular expression values to use those lists. * Search the Splunk platform Getting Data In Manual for "Filter data in XML format with the XmlRegex Key" for details. * Default: false ############################################################################ # Active Directory Monitor ############################################################################ [admon://] * This section explains possible settings for configuring the Active Directory monitor input. * Each admon:// stanza represents an individually configured Active Directory monitoring input. If you configure the input with Splunk Web, then the value of "" matches what was specified there. While you can add Active Directory monitor inputs manually, it is best practice to use Splunk Web to configure Active Directory monitor inputs because it is easy to mistype the values for Active Directory monitor objects. targetDc = * The fully qualified domain name of a valid, network-accessible Active Directory domain controller (DC). * This setting is case sensitive. Do not use 'targetdc' or 'targetDC', but rather 'targetDc'. * Default: The DC that the local host used to connect to AD. The input binds to its root Distinguished Name (DN). startingNode = * Where in the Active Directory directory tree to start monitoring. * The user that you configure Splunk software to run as at installation determines where the input starts monitoring. * Default: the root of the directory tree monitorSubtree = * Whether or not to monitor the subtree(s) of a given Active Directory tree path. * Set this to 1 to monitor subtrees of a given directory tree path and 0 to monitor only the path itself. * Default: 1 (monitor subtrees of a given directory tree path) disabled = * Whether or not the input is enabled. * Set this to 1 to disable the input and 0 to enable it. * Default: 0 (enabled) index = * The index to store incoming data into for this input. * This setting is optional. * Default: the default index printSchema = * Whether or not to print the Active Directory schema. * Set this to 1 to print the schema and 0 to not print the schema. * Default: 1 (print the Active Directory schema) baseline = * Whether or not to query baseline objects. * Baseline objects are objects which currently reside in Active Directory. * Baseline objects also include previously deleted objects. * Set this to 1 to query baseline objects, and 0 to not query baseline objects. * Default: 0 (do not query baseline objects) ############################################################################ # Windows Registry Monitor ############################################################################ [WinRegMon://] * This section explains possible settings for configuring the Windows Registry Monitor input. * Each WinRegMon:// stanza represents an individually configured WinRegMon monitoring input. * If you configure the inputs with Splunk Web, the value of "" matches what was specified there. While you can add event log monitor inputs manually, it is best practice to use Splunk Web to configure Windows registry monitor inputs because it is easy to mistype the values for Registry hives and keys. * The WinRegMon input is for local systems only. You cannot monitor the Registry remotely. proc = * The processes this input should monitor for Registry access. * If set, matches against the process name which performed the Registry access. * The input includes events from processes that match the regular expression that you specify here. * The input filters out events for processes that do not match the regular expression. * Default: .* (match all processes) hive = * The Registry hive(s) that this input should monitor for Registry access. * If set, matches against the Registry key that was accessed. * The input includes events from Registry hives that match the regular expression that you specify here. * The input filters out events for Registry hives that do not match the regular expression. * No default. type = * A regular expression that specifies the type(s) of Registry event(s) that you want the input to monitor. * No default. baseline = * Whether or not the input should get a baseline of Registry events when it starts. * If you set this to 1, the input captures a baseline for the specified hive when it starts for the first time. It then monitors live events. * Default: 0 (do not capture a baseline for the specified hive first before monitoring live events) baseline_interval = * Selects how much downtime in continuous registry monitoring should trigger a new baseline for the monitored hive and/or key. * In detail: * Sets the minimum time interval, in seconds, between baselines. * At startup, a WinRegMon input does not generate a baseline if less time has passed since the last checkpoint than baseline_interval chooses. * In normal operation, checkpoints are updated frequently as data is acquired, so this will cause baselines to occur only when monitoring was not operating for a period of time. * If baseline is set to 0 (disabled), the setting has no effect. * Default: 86400 (1 day) disabled = * Whether or not the input is enabled. * Set this to 1 to disable the input, or 0 to enable it. * Default: 0 (enabled) index = * The index that this input should send the data to. * This setting is optional. * Default: the default index ############################################################################ # Windows Host Monitoring ############################################################################ [WinHostMon://] * This section explains possible settings for configuring the Windows host monitor input. * Gathers status information from the local Windows system components as per the 'type' field, described after this section. * Each WinHostMon:// stanza represents an WinHostMon monitoring input. * The "" component of the stanza name is used as the source field on generated events, unless an explicit source setting is added to the stanza. It does not affect what data is collected (see type setting for that). * If you configure the input in Splunk Web, the value of "" matches what was specified there. * NOTE: The WinHostMon input is for local Windows systems only. You cannot monitor Windows host information remotely. type = * An expression that specifies the type(s) of host inputs that you want the input to monitor. * Type can be (case insensitive): Computer;Process;Processor;NetworkAdapter;Service;OperatingSystem;Disk;Driver;Roles * No default. interval = * The interval, in seconds, between when the input runs to gather Windows host information and generate events. * See 'interval' in the Scripted input section for more information. disabled = * Whether or not the input is enabled. * Set this to 1 to disable the input, or 0 to enable it. * Default: 0 (enabled) index = * The index that this input should send the data to. * This setting is optional. * Default: the default index [WinPrintMon://] * This section explains possible settings for configuring the Windows print monitor input. * Each WinPrintMon:// stanza represents an WinPrintMon monitoring input. The value of "" matches what was specified in Splunk Web. * NOTE: The WinPrintMon input is for local Windows systems only. * The "" component of the stanza name is used as the source field on generated events, unless an explicit source setting is added to the stanza. It does not affect what data is collected (see type setting for that). type = * An expression that specifies the type(s) of print inputs that you want the input to monitor. * Type can be (case insensitive): Printer;Job;Driver;Port * No default. interval = * The interval, in seconds, between when the input runs to gather Windows host information and generate events. * See 'interval' in the Scripted input section for more information. baseline = * Whether or not to capture a baseline of print objects when the input starts for the first time. * If you set this setting to 1, the input captures a baseline of the current print objects when the input starts for the first time. * Default: 0 (do not capture a baseline) disabled = * Whether or not the input is enabled. * Set to 1 to disable the input, or 0 to enable it. * Default: 0 (enabled) index = * The index that this input should send the data to. * This setting is optional. * Default: the default index [WinNetMon://] * This section explains possible settings for configuring a Network Monitor input. * Each WinNetMon:// stanza represents an individually configured network monitoring input. The value of "" matches what was specified in Splunk Web. It is best practice to use Splunk Web to configure Network Monitor inputs because it is easy to mistype the values for Network Monitor objects. remoteAddress = * A regular expression that represents the remote IP address of a host that is involved in network communication. * This setting accepts a regular expression that matches against IP addresses only, not host names. For example: 192\.168\..* * The input includes events for remote IP addresses that match the regular expression that you specify here. * The input filters out events for remote IP addresses that do not match the regular expression. * No default (include all remote address events). process = * A regular expression that represents the process or application that performed a network access. * The input includes events for processes that match the regular expression that you specify here. * The input filters out events for processes that do not match the regular expression. * No default (include all processes and application events). user = * A regular expression that represents the Windows user name that performed a network access. * The input includes events for user names that match the regular expression that you specify here. * The input filters out events for user names that do not match the regular expression. * No default (include all user name events). addressFamily = [ipv4];[ipv6] * Determines the events to include by network address family. * Setting "ipv4" alone includes only IPv4 packets, while "ipv6" alone includes only IPv6 packets. * To specify both families, separate them with a semicolon. For example: ipv4;ipv6 * No default (include events with both address families). packetType = [connect];[accept];[transport] * Determines the events to include by network packet type. * To specify multiple packet types, separate them with a semicolon. For example: connect;transport * No default (include events with any packet type). direction = [inbound];[outbound] * Determines the events to include by network transport direction. * To specify multiple directions, separate them with a semicolon. For example: inbound;outbound * No default (include events with any direction). protocol = [tcp];[udp] * Determines the events to include by network protocol. * To specify multiple protocols, separate them with a semicolon. For example: tcp;udp * For more information about protocols, see http://www.ietf.org/rfc/rfc1700.txt * No default (include events with all protocols) readInterval = * How often, in milliseconds, that the input should read the network kernel driver for events. * Advanced option. Use the default value unless there is a problem with input performance. * Set this to adjust the frequency of calls into the network kernel driver. * Choosing lower values (higher frequencies) can reduce network performance, while higher numbers (lower frequencies) can cause event loss. * The minimum allowed value is 10 and the maximum allowed value is 1000. * Default: 100 driverBufferSize = * The maximum number of packets that the network kernel driver retains for retrieval by the input. * Set to adjust the maximum number of network packets retained in the network driver buffer. * Advanced option. Use the default value unless there is a problem with input performance. * Configuring this setting to lower values can result in event loss, while higher values can increase the size of non-paged memory on the host. * The minimum allowed value is 128 and the maximum allowed value is 32768. * Default: 32768 userBufferSize = * The maximum size, in megabytes, of the user mode event buffer. * Controls amount of packets cached in the the user mode. * Advanced option. Use the default value unless there is a problem with input performance. * Configuring this setting to lower values can result in event loss, while higher values can increase the amount of memory that the network monitor uses. * The minimum allowed value is 20 and the maximum allowed value is 500. * Default: 20 mode = [single|multikv] * Specifies how the network monitor input generates events. * Set to "single" to generate one event per packet. * Set to "multikv" to generate combined events of many packets in multikv format (many packets described in a single table as one event). * Default: single multikvMaxEventCount = * The maximum number of packets to combine in multikv format when you set the 'mode' setting to "multikv". * Has no effect when 'mode' is set to "single". * Advanced option. * The minimum allowed value is 10 and the maximum allowed value is 500. * Default: 100 multikvMaxTimeMs = * The maximum amount of time, in milliseconds, to accumulate packet data to combine into a large tabular event in multikv format. * Has no effect when 'mode' is set to 'single'. * Advanced option. * The minimum allowed value is 100 and the maximum allowed value is 5000. * Default: 1000 sid_cache_disabled = [0|1] * Enables or disables account Security IDentifier (SID) cache. * This setting is global. It affects all Windows Network Monitor stanzas. * Default: 0 sid_cache_exp = * The expiration time, in seconds, for account SID cache entries. * Optional. * This setting is global. It affects all Windows Network Monitor stanzas. * Default: 3600 sid_cache_exp_neg = * The expiration time, in seconds, for negative account SID cache entries. * Optional. * This setting is global. It affects all Windows Network Monitor stanzas. * Default: 10 sid_cache_max_entries = * The maximum number of account SID cache entries. * Optional. * This setting is global. It affects all Windows Network Monitor stanzas. * Default: 10 disabled = * Whether or not the input is enabled. * Set to 1 to disable the input, and 0 to enable it. * Default: 0 (enabled) index = * The index where this input sends the data. * Optional. * Default: the default index # Global settings for the powershell modinput. [powershell] io_threads = * The number of threads that Splunk software spawns to run PowerShell scripts that have been configured in the inputs.conf file. * If you specify a value that is less than or equal to 0, Splunk software autotunes this setting. * The default can vary. Splunk software autotunes the number of threads based on the availability of CPU resources on the machine. serialization_threads = * The number of threads that Splunk software spawns for serialization of PowerShell objects that it has collected into XML strings. * This serialization, or conversion of objects, occurs according to the Modular Input XML protocol. * If you specify a value that is less than or equal to 0, Splunk software autotunes this setting. * The default can vary. Splunk software autotunes the number of threads based on available CPU resources on the machine. event_serialization_format = [kv|json] * The event format into which Powershell objects are serialized. * The supported event formats are "kv" and "json". * For example, given the following PowerShell object: $psObj = @{ A: "a string" B: 18 C: "a log line" } If you set 'event_serialization_format' to "kv", the Splunk platform indexes the event as follows: A="a string" B=18 C="a log line" If you set 'event_serialization_format' to "json", the Splunk platform indexes the event as follows: { "A": "a string", "B": 18, "C": "a log line" } * Default: kv process_completion_check_interval = * The interval, in milliseconds, between which the Splunk platform checks whether a PowerShell process has completed running. * Default: 200 [powershell://] * Runs Windows PowerShell version 3 commands or scripts. script = * A PowerShell command-line script or .ps1 script file that the input should run. * No default. schedule = [|] * How often to run the specified PowerShell command or script. * There are two options available for how to run the command or script: * You can specify a number, which represents how often, in seconds, to run the command or script after the instance starts. * You can specify a "cron" style schedule, which lets you determine the days, hours, minutes, and seconds when the script or command runs. An example cron schedule is "30 * * * *", which means to run the script at 30 minutes past the hour, every hour of every day. * Regardless of which option you choose, the command or script always runs once when the instance starts. * Default: The command or script runs once, when the instance starts. # Global settings for the powershell2 modinput. [powershell2] io_threads = * The number of threads that Splunk software spawns to run PowerShell scripts that have been configured in inputs.conf. * If you specify a value that is less than or equal to 0, Splunk software autotunes this setting. * The default can vary. Splunk software autotunes the number of threads based on the availability of CPU resources on the machine. event_serialization_format = [ kv | json ] * The event format into which Powershell objects are serialized. * The supported event formats are "kv" and "json". * For example, given the following PowerShell object: $psObj = @{ A: "a string" B: 18 C: "a log line" } If you set 'event_serialization_format' to "kv", the Splunk platform indexes the event as follows: A="a string" B=18 C="a log line" If you set 'event_serialization_format' to "json", the Splunk platform indexes the event as follows: { "A": "a string", "B": 18, "C": "a log line" } * Default: kv process_completion_check_interval = * The interval, in milliseconds, between which the Splunk platform checks whether a PowerShell process has completed running. * Default = 200 [powershell2://] * Runs Windows PowerShell version 2 commands or scripts. script = * A PowerShell command-line script or .ps1 script file that the input should run. * No default. schedule = * How often to run the specified PowerShell command or script. * You can provide a valid cron schedule. * Default: Runs the command or script once, at startup. ############################################################################ # Remote Queue Monitor ############################################################################ [remote_queue:] * This section explains possible settings for configuring a remote queue. * Each remote_queue: stanza represents an individually configured remote queue monitoring input. * Note that only 1 remote queue stanza is supported as an input queue. remote_queue.* = * Currently not supported. This setting is related to a feature that is still under development. * Optional. * This section explains possible settings for configuring a remote queue. * With remote queues, the splunk indexer might require additional configuration, specific to the type of remote queue. You can pass configuration information to the splunk indexer by specifying the settings through the following schema: remote_queue.. = . For example: remote_queue.sqs.access_key = ACCESS_KEY * This setting is optional. * No default. disabled = * Whether the remote queue input is active. * A value of "true" means the remote queue input is inactive. * A value of "false" means the remote queue input is active. * Default: false remote_queue.type = [sqs|kinesis|sqs_smartbus|sqs_smartbus_cp|sqs_datalake] * Currently not supported. This setting is related to a feature that is still under development. * Required. * Specifies the remote queue type, which can be "Amazon Web Services (AWS) Simple Queue Service (SQS)", "Amazon Kinesis", "SQS Smartbus", "SQS Smartbus CP" or "SQS Datalake". * If the type is "sqs_smartbus_cp", the [cloud_processor_smartbus_queue] stanza must be present. remote_queue.large_message_store.supports_versioning = * Currently not supported. This setting is related to a feature that is still under development. * Specifies whether or not the remote storage supports versioning. * Versioning is a means of keeping multiple variants of an object in the same bucket on the remote storage. * This setting is optional. * Default: true compressed = * See the description for TCPOUT ATTRIBUTES in outputs.conf.spec. negotiateProtocolLevel = * See the description for TCPOUT ATTRIBUTES in outputs.conf.spec. channelReapInterval = * See the description for TCPOUT ATTRIBUTES in outputs.conf.spec. channelTTL = * See the description for TCPOUT ATTRIBUTES in outputs.conf.spec. channelReapLowater = * See the description for TCPOUT ATTRIBUTES in outputs.conf.spec. concurrentChannelLimit = * See the description for [splunktcp]. ############################################################################ # SQS specific settings ############################################################################ remote_queue.sqs.access_key = * Currently not supported. This setting is related to a feature that is still under development. * The access key to use when authenticating with the remote queue system supporting the SQS API. * If not specified, the indexer looks for these environment variables: 'AWS_ACCESS_KEY_ID' or 'AWS_ACCESS_KEY' (in that order). If the environment variables are not set and the indexer is running on Elastic Compute Cloud (EC2), the indexer attempts to use the secret key from the Identity and Access Management (IAM) role. * This setting is optional. * No default. remote_queue.sqs.secret_key = * Currently not supported. This setting is related to a feature that is still under development. * The secret key to use when authenticating with the remote queue system supporting the SQS API. * If not specified, the indexer looks for these environment variables: AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY (in that order). If the environment variables are not set and the indexer is running on EC2, the indexer attempts to use the secret key from the IAM role. * This setting is optional. * No default. remote_queue.sqs.auth_region = * Currently not supported. This setting is related to a feature that is still under development. * The authentication region to use when signing the requests when interacting with the remote queue system supporting the SQS API. * If not specified and the indexer is running on EC2, the auth_region is constructed automatically based on the EC2 region of the instance where the the indexer is running. * This setting is optional. * No default. remote_queue.sqs.endpoint = * Currently not supported. This setting is related to a feature that is still under development. * The URL of the remote queue system supporting the SQS API. * The scheme, http or https, can be used to enable or disable SSL connectivity with the endpoint. * If not specified, the endpoint is constructed automatically based on the auth_region as follows: https://sqs..amazonaws.com * If specified, the endpoint must match the effective auth_region, which is either a value specified in 'remote_queue.sqs.auth_region' or a value constructed automatically based on the EC2 region of the running instance. * Example: https://sqs.us-west-2.amazonaws.com/ * This setting is optional. * No default. remote_queue.sqs.max_connections = * Currently not supported. This setting is related to a feature that is still under development. * The maximum number of HTTP connections to have in progress for certain queue operations. * A value of 0 means unlimited. * Default: 8 remote_queue.sqs.message_group_id = * Currently not supported. This setting is related to a feature that is still under development. * The Message Group ID for Amazon Web Services Simple Queue Service (SQS) First-In, First-Out (FIFO) queues. * Setting a Message Group ID controls how messages within an AWS SQS queue are processed. * For information on SQS FIFO queues and how messages in those queues are processed, see "Recommendations for FIFO queues" in the AWS SQS Developer Guide. * If you configure this setting, Splunk software assumes that the SQS queue is a FIFO queue, and that messages in the queue should be processed first-in, first-out. * Otherwise, Splunk software assumes that the SQS queue is a standard queue. * Can be between 1-128 alphanumeric or punctuation characters. * NOTE: FIFO queues must have Content-Based Deduplication enabled. * This setting is optional. * No default. remote_queue.sqs.retry_policy = [max_count|none] * Currently not supported. This setting is related to a feature that is still under development. * The retry policy to use for remote queue operations. * A retry policy specifies whether and how to retry file operations that fail for those failures that might be intermittent. * Retry policies: + "max_count": Imposes a maximum number of times a queue operation can be retried upon intermittent failure. + "none": Do not retry file operations upon failure. * This setting is optional. * Default: "max_count" remote_queue.sqs.max_count.max_retries_per_part = * Currently not supported. This setting is related to a feature that is still under development. * When 'remote_queue.sqs.retry_policy' is set to "max_count", sets the maximum number of times a queue operation can be retried upon intermittent failure. * This setting is optional. * Default: 9 remote_queue.sqs.timeout.connect = * Currently not supported. This setting is related to a feature that is still under development. * The connection timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 5 remote_queue.sqs.timeout.read = * Currently not supported. This setting is related to a feature that is still under development. * The read timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 60 remote_queue.sqs.timeout.write = * Currently not supported. This setting is related to a feature that is still under development. * The write timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 60 remote_queue.sqs.timeout.receive_message = * The receive message wait time, in seconds, when interacting with SQS for this queue. * When set to greater than 0, enables "long polling." If there are no messages immediately available, the queue waits at most 'remote_queue.sqs.timeout.receive_message' seconds for a message to become available. * When 0, disables long polling. * When not set, uses the value configured for the queue via the AWS SQS console. * Maximum value: 20 * This setting is optional. * Default: 20 remote_queue.sqs.timeout.visibility = * Currently not supported. This setting is related to a feature that is still under development. * The default "visibility timeout," in seconds, to use when explicitly changing the visibility of specific messages in the queue. * NOTE: Changing the value of 'remote_queue.sqs.timeout.visibility' does not change the implicit visibility timeout configured for the queue in the AWS SQS console. * This setting is optional. * Default: 60 remote_queue.sqs.buffer.visibility = * Currently not supported. This setting is related to a feature that is still under development. * The default time, in seconds, before 'remote_queue.sqs.timeout.visibility' at which visibility of specific messages in the queue needs to be changed. * This setting is optional. * Default: 15 remote_queue.sqs.executor_max_workers_count = * Currently not supported. This setting is related to a feature that is still under development. * The maximum number of worker threads that can be used by indexer per pipeline set to execute SQS tasks. * A value of 0 is equivalent to 1. * Default: 8 remote_queue.sqs.min_pending_messages = * Currently not supported. This setting is related to a feature that is still under development. * The default "minimum number of pending messages" to use before receiving messages off remote queue. Messages are only received when the sum of the internal queue message count and pending object GET (from large messages storage) count is below the set value. * This setting is optional. * Default: 10 remote_queue.sqs.large_message_store.endpoint = * Currently not supported. This setting is related to a feature that is still under development. * The URL of the remote storage system supporting the S3 API. * The scheme, http or https, can be used to enable or disable SSL connectivity with the endpoint. * If not specified, the endpoint is constructed automatically based on the auth_region as follows: https://s3-.amazonaws.com * If specified, the endpoint must match the effective auth_region, which is either a value specified via 'remote_queue.sqs.auth_region' or a value constructed automatically based on the EC2 region of the running instance. * Example: https://s3-us-west-2.amazonaws.com/ * This setting is optional. * No default. remote_queue.sqs.large_message_store.path = * Currently not supported. This setting is related to a feature that is still under development. * The remote storage location where messages that are larger than the underlying queue maximum message size will reside. * The format for this attribute is: :// * The "scheme" identifies a supported external storage system type. * The "remote-location-specifier" is an external system-specific string for identifying a location inside the storage system. * These external systems are supported: - Object stores that support the AWS S3 protocol. These use the scheme "s3". For example, "path=s3://mybucket/some/path". * If not specified, messages exceeding the underlying queue's maximum message size are dropped. * This setting is optional. * No default. ############################################################################ # Kinesis specific settings ############################################################################ remote_queue.kinesis.access_key = * Currently not supported. This setting is related to a feature that is still under development. * Specifies the access key to use when authenticating with the remote queue system supporting the Kinesis API. * If not specified, the forwarder will look for these environment variables: AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY (in that order). If the environment variables are not set and the forwarder is running on EC2, the forwarder attempts to use the secret key from the IAM role. * This setting is optional. * No default. remote_queue.kinesis.secret_key = * Currently not supported. This setting is related to a feature that is still under development. * Specifies the secret key to use when authenticating with the remote queue system supporting the Kinesis API. * If not specified, the forwarder will look for these environment variables: AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY (in that order). If the environment variables are not set and the forwarder is running on EC2, the forwarder attempts to use the secret key from the IAM role. * This setting is optional. * No default. remote_queue.kinesis.auth_region = * Currently not supported. This setting is related to a feature that is still under development. * The authentication region to use when signing the requests when interacting with the remote queue system supporting the Kinesis API. * If not specified and the forwarder is running on EC2, the auth_region will be constructed automatically based on the EC2 region of the instance where the the forwarder is running. * This setting is optional. * No default. remote_queue.kinesis.endpoint = * Currently not supported. This setting is related to a feature that is still under development. * The URL of the remote queue system supporting the Kinesis API. * The scheme, http or https, can be used to enable or disable SSL connectivity with the endpoint. * If not specified, the endpoint is constructed automatically based on the auth_region as follows: https://kinesis..amazonaws.com * If specified, the endpoint must match the effective auth_region, which is either a value specified via 'remote_queue.kinesis.auth_region' or a value constructed automatically based on the EC2 region of the running instance. * Example: https://kinesis.us-west-2.amazonaws.com/ * This setting is optional. * No default. remote_queue.kinesis.retry_policy = [max_count|none] * The retry policy to use for remote queue operations. * A retry policy specifies whether and how to retry file operations that fail for those failures that might be intermittent. * Retry policies: + "max_count": Imposes a maximum number of times a queue operation will be retried upon intermittent failure. + "none": Do not retry file operations upon failure. * This setting is optional. * Default: "max_count" remote_queue.kinesis.max_count.max_retries_per_part = * When 'remote_queue.kinesis.retry_policy' is "max_count", sets the maximum number of times a queue operation is retried upon intermittent failure. * This setting is optional. * Default: 9 remote_queue.kinesis.timeout.connect = * Currently not supported. This setting is related to a feature that is still under development. * The connection timeout, in milliseconds, when interacting with Kinesis for this queue. * This setting is optional. * Default: 5000 remote_queue.kinesis.timeout.read = * Currently not supported. This setting is related to a feature that is still under development. * The read timeout, in milliseconds, when interacting with Kinesis for this queue. * This setting is optional. * Default: 60000 remote_queue.kinesis.timeout.write = * Currently not supported. This setting is related to a feature that is still under development. * The write timeout, in milliseconds, when interacting with Kinesis for this queue. * This setting is optional. * Default: 60000 remote_queue.kinesis.executor_max_workers_count = * Currently not supported. This setting is related to a feature that is still under development. * The maximum number of worker threads that can be used by indexer per pipeline set to execute kinesis queue tasks. * A value of 0 is equivalent to 1. * Default: 8 remote_queue.kinesis.max_messages = * Currently not supported. This setting is related to a feature that is still under development. * The default "maximum number of messages" (that are received from remote_queue endpoint) to store in kinesis in-memory message queue. * This setting is optional. * Default: 10000 remote_queue.kinesis.min_pending_messages = * Currently not supported. This setting is related to a feature that is still under development. * The default "minimum number of pending messages" to use before receiving messages off kinesis in-memory message queue. Messages are only received when sum of internal queue message count and pending object GET (from large messages storage) count is below the set value. * This setting is optional. * Default: 50 remote_queue.kinesis.max_checkpoints = * Currently not supported. This setting is related to a feature that is still under development. * The default "maximum number of messages" (that have been received from remote_queue endpoint and completely consumed) to store in the Kinesis in-memory checkpoint queue. * This setting is optional. * Default: 100000 remote_queue.kinesis.roll_remote_buckets_interval = * Currently not supported. This setting is related to a feature that is still under development. * The default interval, in seconds, that the Kinesis remote queue input worker waits before it rolls the remote storage enabled buckets. * This setting is optional. * Default: 30 remote_queue.kinesis.large_message_store.endpoint = * Currently not supported. This setting is related to a feature that is still under development. * The URL of the remote storage system supporting the S3 API. * The scheme, http or https, can be used to enable or disable SSL connectivity with the endpoint. * If not specified, the endpoint will be constructed automatically based on the auth_region as follows: https://s3-.amazonaws.com * If specified, the endpoint must match the effective auth_region, which is either a value specified via 'remote_queue.kinesis.auth_region' or a value constructed automatically based on the EC2 region of the running instance. * Example: https://s3-us-west-2.amazonaws.com/ * This setting is optional. * No default. remote_queue.kinesis.large_message_store.path = * Currently not supported. This setting is related to a feature that is still under development. * The remote storage location where messages larger than the underlying queue maximum message size will reside. * The format for this attribute is: :// * The "scheme" identifies a supported external storage system type. * The "remote-location-specifier" is an external system-specific string for identifying a location inside the storage system. * These external systems are supported: - Object stores that support AWS's S3 protocol. These use the scheme "s3". For example, "path=s3://mybucket/some/path". * If not specified, messages exceeding the underlying queue maximum message size are dropped. * This setting is optional. * No default. ############################################################################ # Simple Queue Service Smartbus (SQS Smartbus) or Simple Queue Service Smartbus CP (SQS Smartbus CP) specific settings ############################################################################ # The settings for SQS Smartbus (sqs_smartbus) and SQS Smartbus CP (sqs_smartbus_cp) are identical in the remote queue input. # The following section uses "sqs_smartbus" as an example. remote_queue.sqs_smartbus.access_key = * Currently not supported. This setting is related to a feature that is still under development. * The access key to use when authenticating with the remote queue system supporting the SQS API. * If not specified, the indexer looks for these environment variables: 'AWS_ACCESS_KEY_ID' or 'AWS_ACCESS_KEY' (in that order). If the environment variables are not set and the indexer is running on Elastic Compute Cloud (EC2), the indexer attempts to use the secret key from the Identity and Access Management (IAM) role. * This setting is optional. * No default. remote_queue.sqs_smartbus.secret_key = * Currently not supported. This setting is related to a feature that is still under development. * The secret key to use when authenticating with the remote queue system supporting the SQS API. * If not specified, the indexer looks for these environment variables: AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY (in that order). If the environment variables are not set and the indexer is running on EC2, the indexer attempts to use the secret key from the IAM role. * This setting is optional. * No default. remote_queue.sqs_smartbus.auth_region = * Currently not supported. This setting is related to a feature that is still under development. * The authentication region to use when signing the requests when interacting with the remote queue system supporting the SQS API. * If not specified and the indexer is running on EC2, the auth_region is constructed automatically based on the EC2 region of the instance where the the indexer is running. * This setting is optional. * No default. remote_queue.sqs_smartbus.endpoint = * Currently not supported. This setting is related to a feature that is still under development. * The URL of the remote queue system supporting the SQS API. * The scheme, http or https, can be used to enable or disable SSL connectivity with the endpoint. * If not specified, the endpoint is constructed automatically based on the auth_region as follows: https://sqs..amazonaws.com * If specified, the endpoint must match the effective auth_region, which is either a value specified in 'remote_queue.sqs.auth_region' or a value constructed automatically based on the EC2 region of the running instance. * Example: https://sqs.us-west-2.amazonaws.com/ * This setting is optional. * No default. remote_queue.sqs_smartbus.max_connections = * Currently not supported. This setting is related to a feature that is still under development. * The maximum number of HTTP connections that can be simultaneously in progress for certain queue operations. * A value of 0 means unlimited. * Default: 8 remote_queue.sqs_smartbus.message_group_id = * Currently not supported. This setting is related to a feature that is still under development. * The Message Group ID for Amazon Web Services Simple Queue Service (SQS) First-In, First-Out (FIFO) queues. * Setting a Message Group ID controls how messages within an AWS SQS queue are processed. * For information on SQS FIFO queues and how messages in those queues are processed, see "Recommendations for FIFO queues" in the AWS SQS Developer Guide. * If you configure this setting, Splunk software assumes that the SQS queue is a FIFO queue, and that messages in the queue should be processed first-in, first-out. * Otherwise, Splunk software assumes that the SQS queue is a standard queue. * Can be between 1-128 alphanumeric or punctuation characters. * NOTE: FIFO queues must have Content-Based Deduplication enabled. * This setting is optional. * No default. remote_queue.sqs_smartbus.retry_policy = [max_count|none] * Currently not supported. This setting is related to a feature that is still under development. * The retry policy to use for remote queue operations. * A retry policy specifies whether and how to retry file operations that fail for those failures that might be intermittent. * Retry policies: + "max_count": Imposes a maximum number of times a queue operation can be retried upon intermittent failure. + "none": Do not retry file operations upon failure. * This setting is optional. * Default: "max_count" remote_queue.sqs_smartbus.max_count.max_retries_per_part = * Currently not supported. This setting is related to a feature that is still under development. * When 'remote_queue.sqs_smartbus.retry_policy' is set to "max_count", sets the maximum number of times a queue operation can be retried upon intermittent failure. * This setting is optional. * Default: 3 remote_queue.sqs_smartbus.timeout.connect = * Currently not supported. This setting is related to a feature that is still under development. * The connection timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 5 remote_queue.sqs_smartbus.timeout.read = * Currently not supported. This setting is related to a feature that is still under development. * The read timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 60 remote_queue.sqs_smartbus.timeout.write = * Currently not supported. This setting is related to a feature that is still under development. * The write timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 60 remote_queue.sqs_smartbus.timeout.receive_message = * The receive message wait time, in seconds, when interacting with SQS for this queue. * When set to greater than 0, enables "long polling." If there are no messages immediately available, the queue waits at most 'remote_queue.sqs.timeout.receive_message' seconds for a message to become available. * When 0, disables long polling. * When not set, uses the value configured for the queue via the AWS SQS console. * Maximum value: 20 * This setting is optional. * Default: 20 remote_queue.sqs_smartbus.timeout.visibility = * Currently not supported. This setting is related to a feature that is still under development. * The default "visibility timeout," in seconds, to use when explicitly changing the visibility of specific messages in the queue. * NOTE: Changing the value of 'remote_queue.sqs.timeout.visibility' does not change the implicit visibility timeout configured for the queue in the AWS SQS console. * This setting is optional. * Default: 300 remote_queue.sqs_smartbus.buffer.visibility = * Currently not supported. This setting is related to a feature that is still under development. * The default time, in seconds, before 'remote_queue.sqs.timeout.visibility' at which visibility of specific messages in the queue needs to be changed. * This setting is optional. * Default: 15 remote_queue.sqs_smartbus.executor_max_workers_count = * Currently not supported. This setting is related to a feature that is still under development. * The maximum number of worker threads that can be used by indexer per pipeline set to execute SQS tasks. * A value of 0 is equivalent to 1. * Default: 4 remote_queue.sqs_smartbus.min_pending_messages = * Currently not supported. This setting is related to a feature that is still under development. * The default "minimum number of pending messages" to use before receiving messages off remote queue. Messages are only received when the sum of internal queue message count and pending object GET (from large messages storage) count is below the set value. * This setting is optional. * Default: 10 remote_queue.sqs_smartbus.renew_retries = * Currently not supported. This setting is related to a feature that is still under development. * The number of retries for a particular message on a given indexer after being received from the remote queue, before it is proactively moved to the DLQ folder. * Default: 50 remote_queue.sqs_smartbus.large_message_store.endpoint = * Currently not supported. This setting is related to a feature that is still under development. * The URL of the remote storage system supporting the S3 API. * The scheme, http or https, can be used to enable or disable SSL connectivity with the endpoint. * If not specified, the endpoint is constructed automatically based on the auth_region as follows: https://s3-.amazonaws.com * If specified, the endpoint must match the effective auth_region, which is either a value specified via 'remote_queue.sqs_smartbus.auth_region' or a value constructed automatically based on the EC2 region of the running instance. * Example: https://s3-us-west-2.amazonaws.com/ * This setting is optional. * No default. remote_queue.sqs_smartbus.large_message_store.path = * Currently not supported. This setting is related to a feature that is still under development. * The remote storage location where messages that are larger than the underlying queue maximum message size will reside. * The format for this attribute is: :// * The "scheme" identifies a supported external storage system type. * The "remote-location-specifier" is an external system-specific string for identifying a location inside the storage system. * These external systems are supported: - Object stores that support the AWS S3 protocol. These use the scheme "s3". For example, "path=s3://mybucket/some/path". * If not specified, messages exceeding the underlying queue's maximum message size are dropped. * This setting is optional. * No default. remote_queue.sqs_smartbus.large_message_store.sslVerifyServerCert = * If set to true, the Splunk platform verifies the certificate presented by the S3 server and checks that the common name and alternate name match the ones specified in 'remote_queue.sqs_smartbus.large_message_store.sslCommonNameToCheck' and 'remote_queue.sqs_smartbus.large_message_store.sslAltNameToCheck'. * Default: false remote_queue.sqs_smartbus.large_message_store.sslVersions = * Comma-separated list of SSL versions to connect to 'remote.sqs_smartbus.large_message_store.endpoint'. * The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2". * The special version "*" selects all supported versions. The version "tls" selects all versions tls1.0 or newer. * If a version is prefixed with "-" it is removed from the list. * SSLv2 is always disabled; "-ssl2" is accepted in the version list but does nothing. * When configured in FIPS mode, ssl3 is always disabled regardless of this configuration. * Default: tls1.2 remote_queue.sqs_smartbus.large_message_store.sslCommonNameToCheck = , , .. * If this value is set, and 'remote_queue.sqs_smartbus.large_message_store.sslVerifyServerCert' is set to true, the Splunk platform instance checks the common name of the certificate presented by the remote server (specified in 'remote_queue.sqs_smartbus.large_message_store.endpoint') against this list of common names. * Default: not set remote_queue.sqs_smartbus.large_message_store.sslAltNameToCheck = , , .. * If this value is set, and 'remote_queue.sqs_smartbus.large_message_store.sslVerifyServerCert' is set to true, the Splunk platform instance checks the alternate name(s) of the certificate presented by the remote server (specified in 'remote_queue.sqs_smartbus.large_message_store.endpoint') against this list of subject alternate names. * Default: not set remote_queue.sqs_smartbus.large_message_store.sslRootCAPath = * Full path to the Certificate Authority (CA) certificate PEM format file containing one or more certificates concatenated together. The S3 certificate will be validated against the CAs present in this file. * Default: [sslConfig/caCertFile] in server.conf remote_queue.sqs_smartbus.large_message_store.cipherSuite = * If set, uses the specified cipher string for the SSL connection. * If not set, uses the default cipher string. * Must specify 'dhFile' to enable any Diffie-Hellman ciphers. * Default: TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH remote_queue.sqs_smartbus.large_message_store.ecdhCurves = * ECDH curves to use for ECDH key negotiation. * Specify the curves in the order of preference. * The client sends these curves as a part of Client Hello. * Splunk software only supports named curves specified by their short names. * The list of valid named curves by their short/long names can be obtained by executing this command: $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves * e.g. ecdhCurves = prime256v1,secp384r1,secp521r1 * Default: not set remote_queue.sqs_smartbus.large_message_store.dhFile = * PEM format Diffie-Hellman parameter file name. * DH group size must be no less than 2048bits. * This file is required in order to enable any Diffie-Hellman ciphers. * Optional * Default: not set remote_queue.sqs_smartbus.dead_letter_queue.name = * Currently not supported. This setting is related to a feature that is still under development. * The name of the dead letter queue. remote_queue.sqs_smartbus.dead_letter_queue.process_interval = * Currently not supported. This setting is related to a feature that is still under development. * The frequency of processing messages that have landed in the dead letter queue. * Examples: 30s, 6h * Default: 1d remote_queue.sqs_smartbus.large_message_store.encryption_scheme = [sse-s3|sse-c|none] * Currently not supported. This setting is related to a feature that is still under development. * The encryption scheme used by remote storage * Default: none. remote_queue.sqs_smartbus.large_message_store.kms_endpoint = * Currently not supported. This setting is related to a feature that is still under development. * The endpoint to connect to for generating KMS keys. * This setting is required if 'large_message_store.encryption_scheme' is set to sse-c. * Examples: https://kms.us-east-2.amazonaws.com * No default. remote_queue.sqs_smartbus.large_message_store.key_id = * Currently not supported. This setting is related to a feature that is still under development. * The ID for the primary key that KMS uses to generate a data key pair. The primary key is stored in AWS. * This setting is required if 'large_message_store.encryption_scheme' is set to sse-c. * Examples: alias/sqsssekeytrial, 23456789-abcd-1234-11aa-c50f99011223 * No default. remote_queue.sqs_smartbus.large_message_store.key_refresh_interval = * Currently not supported. This setting is related to a feature that is still under development. * The time interval to refresh primary key. * Default: 24h ############################################################################ # Settings specific to Simple Queue Service Datalake (SQS Datalake) ############################################################################ * NOTE: Change the settings in this section only when instructed to do so by Splunk Support. remote_queue.sqs_datalake.message_type = * Currently not supported. This setting is related to a feature that is still under development. * The expected type of message notified through AWS SQS. * Currently only the "asl" message type is supported. * This setting is required. * No default. remote_queue.sqs_datalake.file_format = * Currently not supported. This setting is related to a feature that is still under development. * The expected format of file downloaded from datalake. * Currently only "parquet" type is supported. * This setting is mandatory. * No default. remote_queue.sqs_datalake.sourcetype = * Currently not supported. This setting is related to a feature that is still under development. * The source type that the indexer applies to events it indexes from data lake files * Default: "aws:asl" remote_queue.sqs_datalake.auth_region = * Currently not supported. This setting is related to a feature that is still under development. * The authentication region to use when signing the requests when interacting with the remote queue system supporting the SQS API. * If this setting is not specified and the indexer is running on EC2, the indexer automatically constructs the 'auth_region' based on the EC2 region of the Splunk platform instance where the indexer is running. * This setting is optional. * No default. remote_queue.sqs_datalake.max_connections = * Currently not supported. This setting is related to a feature that is still under development. * The maximum number of HTTP connections that can be simultaneously in progress for certain queue operations. * A value of 0 means unlimited. * Default: 8 remote_queue.sqs_datalake.retry_policy = [max_count|none] * Currently not supported. This setting is related to a feature that is still under development. * The retry policy to use for remote queue operations. * A retry policy specifies whether and how to retry file operations that fail for those failures that might be intermittent. * Retry policies: * "max_count": Imposes a maximum number of times a queue operation can be retried upon intermittent failure. * Use 'remote_queue.sqs_datalake.max_count.max_retries_per_part' to set the maximum retry limit. * "none": Do not retry file operations upon failure. * This setting is optional. * Default: "max_count" remote_queue.sqs_datalake.max_count.max_retries_per_part = * Currently not supported. This setting is related to a feature that is still under development. * When 'remote_queue.sqs_datalake.retry_policy' is set to "max_count", this setting sets the maximum number of times that Splunk software can retry a queue operation upon intermittent failure. * This setting is optional. * Default: 3 remote_queue.sqs_datalake.timeout.connect = * Currently not supported. This setting is related to a feature that is still under development. * The connection timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 5 remote_queue.sqs_datalake.timeout.read = * Currently not supported. This setting is related to a feature that is still under development. * The read timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 60 remote_queue.sqs_datalake.timeout.write = * Currently not supported. This setting is related to a feature that is still under development. * The write timeout, in seconds, when interacting with SQS for this queue. * This setting is optional. * Default: 60 remote_queue.sqs_datalake.timeout.receive_message = * Currently not supported. This setting is related to a feature that is still under development. * The receive message wait time, in seconds, when interacting with SQS for this queue. * When set to a value greater than 0, this setting facilitates "long polling." If there are no messages immediately available, the queue waits at most 'remote_queue.sqs_datalake.timeout.receive_message' seconds for a message to become available. * Maximum value: 20 * When this setting is set to 0, long polling is not active. * This setting is optional. * Default: 20 remote_queue.sqs_datalake.timeout.visibility = * Currently not supported. This setting is related to a feature that is still under development. * The "visibility timeout," in seconds, to use when explicitly changing the visibility of specific messages in the queue. * NOTE: Changing the value of 'remote_queue.sqs_datalake.timeout.visibility' does not change the implicit visibility timeout configured for the queue in the AWS SQS console. * This setting always overrides the AWS SQS console visibility timeout. * This setting is optional. * Default: 300 remote_queue.sqs_datalake.buffer.visibility = * Currently not supported. This setting is related to a feature that is still under development. * The time, in seconds, before 'remote_queue.sqs_datalake.timeout.visibility' at which visibility of specific messages in the queue needs to be changed. * This setting is optional. * Default: 15 remote_queue.sqs_datalake.min_pending_messages = * Currently not supported. This setting is related to a feature that is still under development. * The "minimum number of pending messages" that the indexer uses before it can receive messages off of the remote queue. * The indexer receives messages only when the sum of the internal queue message count and the pending object GET count (from large messages storage) is below the value for this setting. * This setting is optional. * Default: 10 remote_queue.sqs_datalake.large_message_store.encryption_scheme = [sse-s3|sse-kms|none] * Currently not supported. This setting is related to a feature that is still under development. * The encryption scheme used by remote storage. * If you set this setting to "sse-kms" you must also provide values for 'remote_queue.sqs_datalake.large_message_store.kms.region' and 'remote_queue.sqs_datalake.large_message_store.kms.key_id'. * No default. remote_queue.sqs_datalake.large_message_store.kms.auth_region = * The authentication region to use for signing requests when interacting with the Amazon Security Lake storage system that supports the Amazon S3 API. * Used with v4 signatures only. * The instance automatically constructs the Amazon S3 endpoint based on the bucket name and region specified in the SQS message (for example, https://.s3-us-west-1.amazonaws.com). When the SQS message does not provide a 'kms.auth_region', the instance attempts to extract the value from the Amazon s3 endpoint URL ("us-west-1" in the given example) for KMS authentication. * If this setting is not set and the instance cannot determine an authentication region, the instance signs the request with an empty region value. This can lead to rejected requests when non-AWS S3-compatible storage is used. * Optional. * No default. remote_queue.sqs_datalake.large_message_store.kms.key_id = * Currently not supported. This setting is related to a feature that is still under development. * Specifies the identifier for KMS. The identifier is one of the following two things: * The unique key ID for the primary key that KMS uses to generate a data key pair. The primary key is stored in AWS. * The Amazon Resource Name (ARN) of the KMS or the alias name or the ARN of an alias that refers to the KMS. * This setting is required when 'large_message_store.encryption_scheme' is set to "sse-kms". * Examples: Unique key ID: 1234abcd-12ab-34cd-56ef-1234567890ab AWS KMS ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab Alias name: alias/ExampleAlias Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias * No default. remote_queue.sqs_datalake.large_message_store.kms.key_refresh_interval = * Currently not supported. This setting is related to a feature that is still under development. * The time interval to refresh the primary key. * Default: 24h ############################################################################ # Modular Inputs ############################################################################ python.version = [default|python|python2|python3|python3.7|python3.9|latest] * For Python scripts only, selects which Python version to use. * Either "default" or "python" select the system-wide default Python version. * Set to "python3" or "python3.7" to use the Python 3.7 version. * Set to "python3.9" to use the Python 3.9 version. * In the context of configuring apps, the "latest" value is not currently supported. It is related to a feature that is still under development. * Optional. * Default: Not set; uses the system-wide Python version. run_introspection = * Whether or not Splunk software runs introspection on a modular input scheme when you have disabled all of its associated scripts by using the 'disabled = 1' setting. * This setting applies only for modular inputs. It takes effect only if you specify it under a default stanza of a modular input scheme. * A default stanza of a modular input scheme begins with the notation [] * If set to "true", Splunk software runs introspection on a modular input scheme even when you have disabled all the input scripts for the scheme. * If set to "false", Splunk software does not run introspection on a modular input scheme where you have disabled all scripts for the scheme. * If introspection does not run for a scheme, then Splunk software does not register the modular input scripts that are associated with the scheme for execution and it is disabled completely. * Use the 'disabled' setting to enable or disable individual modular input scripts. * For example, to turn introspection off for the modular input scheme "myScheme": [myScheme] run_introspection = false * Default: true ############################### # LOGD (logd input for macOS) ############################### [logd://] * This is the macOS logd input component for the Splunk platform. logd-backtrace = * Whether or not the logd input includes backtraces. * A value of “true” means that the logd input includes backtraces in its events. * Default: false logd-debug = * Whether or not the logd input includes "Debug" events. * A value of “true” means that the logd input includes “Debug” level events. * Default: false logd-info = * Whether or not the logd input includes "Info" events. * A value of “true” means that the logd input includes “Info” level events. * Default: true logd-loss = * Whether or not the logd input includes message loss events. * A value of “true” means that the logd input includes message loss events. * Default: false logd-signpost = * Whether or not the logd input includes signposts. * A value of “true” means that the logd input includes signpost events. * Default: false logd-predicate = * Filters messages using the provided predicate, or filter expression, that is based on the NSPredicate definition. * The input supports a single predicate, but the predicate can be a compound one. * Default: none logd-process = * The process ID on which to operate. * You can supply multiple process IDs with commas, for example "220,221,223". * Default: none logd-source = * Whether or not to include symbol names and source line numbers for messages, if available. * Default: false logd-include-fields = * The fields to retrieve from a logD record. * Default: all logd-exclude-fields = * The fields to ignore when parsing a logD record * Example setting: logd-exclude-fields = bootUUID,formatString * Default: formatString,timestamp,timezoneName logd-interval = * How often, in seconds, that the input is to query logd for events, * Default: 30 logd-starttime = * The earliest acceptable time for the input to query logd for events. * Use the format "YYYY-MM-DD HH:MM:SS" to specify the timestamp. * No default. logd-freetext = * reserved for future use ####################################### # JOURNALD (journald input for Linux) ####################################### [journald://] * This is the systemd-journald input component for Splunk journalctl-include-fields = * This setting and the "journalctl-exclude-fields" setting control the fields that the journald input retrieves. * The input selects most of the fields if they are in "one of "journalctl-include-fields" and not in 'journalctl-exclude-fields'. * The exceptions are MESSAGE, CURSOR, and _REALTIME_TIMESTAMP. The system treats these fields specially. * An empty 'journalctl-include-fields' value means to output all fields. * If you want all fields except XYZ, leave 'journalctl-include-fields' empty, and set "journalctl-exclude-fields=XYZ". * The input always retrieves the MESSAGE, __REALTIME_TIMESTAMP, and __CURSOR fields, but uses the __REALTIME_TIMESTAMP and __CURSOR fields internally and does not send them to the Splunk platform. * Fields __MONOTONIC_TIMESTAMP and __SOURCE_REALTIME_TIMESTAMP should always be suppressed to decrease cardinality of data. Use Splunk event time instead. * Default: PRIORITY,_SYSTEMD_UNIT,_SYSTEMD_CGROUP,_TRANSPORT,_PID,_UID, _MACHINE_ID,_GID,_COMM,_EXE journalctl-exclude-fields = * The fields to exclude. use this setting to filter which fields to send to the Splunk platform. * This filter is more computationally expensive than journalctl-output-fields, as it is not natively supported by API and requires post-processing * Default: __MONOTONIC_TIMESTAMP,__SOURCE_REALTIME_TIMESTAMP journalctl-filter = * These settings map directly to the arguments for the journalctl command. See the documentation for journalctl. * Default: none journalctl-unit = * Equivalent to ‘-u’ parameter of journalctl; show messages for the specified systemd unit * Default: none journalctl-identifier = * Equivalent to ‘-t’ parameter of journalctl; show messages for the specified syslog identifier SYSLOG_IDENTIFIER * Default: none journalctl-priority = * equivalent to ‘-p’ parameter of journalctl; filter output by message priorities or priority ranges. * Default: 7 journalctl-boot = * Equivalent to ‘-b’ parameter of journalctl; messages from a specific boot * Default: none journalctl-facility = * Equivalent to ‘--facility’ parameter of journalctl, syslog facility * Default: none journalctl-grep = * Equivalent to ‘-g’ parameter of journalctl; filter output to entries where the MESSAGE= field matches the specified regular expression. PERL-compatible regular expressions are used * Default: none journalctl-user-unit = * Equivalent to ‘--user-unit’ parameter of journalctl; show messages for the specified user session unit. * Default: none journalctl-dmesg = * Equivalent to ‘-k’ parameter of journalctl; show only kernel messages. * Default: false journalctl-quiet = * Equivalent to ‘-q’ parameter of journalctl; suppress all informational messages * Default: false journalctl-freetext = * reserved for future use #### # Cloud Processor Smartbus Queue Input #### [cloud_processor_smartbus_queue::] * This section explains possible settings for configuring a cloud processor smartbus queue. * Each cloud_processor_smartbus_queue stanza represents an individually configured cloud processor smartbus queue input. * NOTE: Only 1 cloud processor smartbus queue stanza is supported as an input queue. * This section explains possible settings for configuring a cloud processor smartbus queue. #### # cloud processor smartbus Queue (CP Smartbus Queue) specific settings #### encoding_format = s2s * Currently not supported. This setting is related to a feature that is still under development. * Specifies the encoding format used to write data to the cloud processor smartbus queue. * Default: s2s retry_policy = max_count|none * Sets the retry policy to use for cloud processor smartbus queue operations. * Optional. * A retry policy specifies whether and how to retry file operations that fail for those failures that might be intermittent. * Retry policies: + "max_count": Imposes a maximum number of times a queue operation is retried upon intermittent failure. Set "max_count" with the 'max_count.max_retries_per_part' setting. + "none": Do not retry file operations upon failure. * Default: max_count max_count.max_retries_per_part = * When 'retry_policy' is set to "max_count", sets the maximum number of times a queue operation will be retried upon intermittent failure. * Optional. * Default: 3 large_message_store.sslVerifyServerCert = * If set to "true", the Splunk platform verifies the certificate presented by the S3 server and checks that the common name and alternate name match the ones specified in 'large_message_store.sslCommonNameToCheck' and 'large_message_store.sslAltNameToCheck'. * Default: false large_message_store.sslVersions = * Comma-separated list of SSL versions to connect to the large message store. * The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2". * The special version "*" selects all supported versions. The version "tls" selects all versions tls1.0 or newer. * If a version is prefixed with "-", then it is removed from the list. * SSLv2 is always disabled; "-ssl2" is accepted in the version list, but has no effect. * When configured in FIPS mode, ssl3 is always disabled regardless of this configuration. * Default: tls1.2 large_message_store.sslRootCAPath = * Full path to the Certificate Authority (CA) certificate PEM format file containing one or more certificates concatenated together. The S3 certificate is validated against the CAs present in this file. * Default: The value of [sslConfig]/'caCertFile' in server.conf large_message_store.cipherSuite = * If set, uses the specified cipher string for the SSL connection. * If not set, uses the default cipher string. * You must specify 'dhFile' to enable any Diffie-Hellman ciphers. * Default: TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH large_message_store.ecdhCurves = * ECDH curves to use for ECDH key negotiation. * Specify the curves in the order of preference. * The client sends these curves as a part of Client Hello. * Splunk software only supports named curves specified by their short names. * The list of valid named curves by their short/long names can be obtained by executing this command: $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves * e.g. ecdhCurves = prime256v1,secp384r1,secp521r1 * Default: not set large_message_store.encryption_scheme = sse-s3 | none * Currently not supported. This setting is related to a feature that is still under development. * The encryption scheme used by remote storage. * Default: none. large_message_store.key_refresh_interval = * Currently not supported. This setting is related to a feature that is still under development. * The time interval to refresh primary key. * Default: 24h