Summary

In this chapter, we learned heaps about configuration settings for various data inputs that are very useful when getting data into Splunk. We began with the steps to install a UF and jumped into the file and directory monitoring input, understanding how this is used to monitor files and directories recursively. We also learned about … (the three-dot notation/ellipsis used to traverse the directories in the filesystem path recursively) and * (the wildcard notation) in a monitor file path. We understood the use of fishbucket to keep track of files monitored using checksums and how it can be reset using the btprobe command.

We looked into network inputs used to accept data over TCP/UDP. TCP is more reliable than UDP, although their configuration specifications are very similar. Afterward, we covered the scripted input type that executes scheduled scripts and indexes transient data. Scripted inputs are commonly utilized in numerous Splunkbase apps, necessitating adherence...