From 75d483d078ad35597fdb70e8b3af43106ddf4d66 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rgen=20Maas?= Date: Wed, 30 Sep 2020 15:26:17 +0200 Subject: [PATCH] Add some docs --- README.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 2c9912f..f0a6698 100644 --- a/README.md +++ b/README.md @@ -1 +1,17 @@ -# Splunk-TA-journald +# Splunk TA journald + +This TA is a very simple method to collect the Linux journald logs into Splunk. It was created to quickly onboard Linux events without reverting back to installing rsyslogd to read from the journal. If you need the journald logs from endpoints not running Splunk Universal Forwarder, this solution is not for you! + +## Implementation details +- It's implemented using a simple bash script called from a scripted input. +- Events are pulled from journald every 30 seconds using journalctl. +- The events are retreived in JSON format and the provided input configuration handles this accordingly. +- The script maintains state so that you don't end up with duplicate events. +- On the first run it will only pull todays events from the journal. + +## Deployment +The TA can be pushed to all Splunk components in your architecture: +- Universal Forwarders +- Indexers +- Search Heads +- Management instances (license master, deployer, cluster master, etc)