View source for Splunk

== ProBook 6550b ==

 root@paardenpad:~# dpkg -i splunk-6.2.1-245427-linux-2.6-amd64.deb 

 root@paardenpad:~# su splunk
 splunk@paardenpad:/ /opt/splunk/bin/splunk start

* Accept license 

 root@paardenpad:/opt/splunk# bin/splunk enable boot-start
 root@paardenpad:/var/log# usermod -a -G adm splunk

== /root/scripts/copyLogs ==

 #!/bin/bash
 rsync -aze --delete --exclude='*.gz' /var/log/* /home/rijk/logs
 chown -R rijk /home/rijk/logs
 chmod -R 744 /home/rijk/logs

 root@paardenpad:/var/www# vim /etc/crontab

* Add line

 0 * * * *   root /root/scripts/copyLogs >/dev/null 2>&1

 knollenpad:~ # vim /etc/crontab

* Add line

 10    * * * * rsync -aze --delete -e ssh olimex:/home/rijk/logs/* /home/rijk/olimexLogs

Add logs to Splunk