<commit_before># Splunk Forwarder on Diamanti
This is a simple walk through deploying an `inputs.conf` to a Diamanti cluster.

## Requirements
- This assumes that you already have a working Splunk installation.
- You have installed and configured the Universal Splunk Forwarder, the RPM can be aquired from [Splunk Downloads](https://www.splunk.com/en_us/download/universal-forwarder.html)

## Modifying inputs.conf
Modify the following variables `{{ HOSTNAME }}`,`{{ DEFAULT INDEX TO PUSH TO }}` in the supplied inputs.conf

If you would like to push certain types of logs to certain indexes then please uncomment and modify the following `{{ SOME INDEX NAME FOR SYSTEM LEVEL LOGS }}`,`{{ SOME INDEX NAME FOR CONTAINER LOGS }}`

## Things to keep in mind

The Docker json logging driver treats each line as a separate message. When using the Docker logging driver, there is no direct support for multi-line messages. You need to handle multi-line messages at the logging agent level or higher<commit_msg>update splunk documentation with the needed info on transforms<commit_after># Splunk Forwarder on Diamanti
This is a simple walk through deploying an `inputs.conf` to a Diamanti cluster.

## Requirements
- This assumes that you already have a working Splunk installation.
- You have installed and configured the Universal Splunk Forwarder, the RPM can be aquired from [Splunk Downloads](https://www.splunk.com/en_us/download/universal-forwarder.html)

## Modifying inputs.conf
Modify the following variables `{{ HOSTNAME }}`,`{{ DEFAULT INDEX TO PUSH TO }}` in the supplied inputs.conf

If you would like to push certain types of logs to certain indexes then please uncomment and modify the following `{{ SOME INDEX NAME FOR SYSTEM LEVEL LOGS }}`,`{{ SOME INDEX NAME FOR CONTAINER LOGS }}`

## Using the proper Transform settings
In order for splunk to properly parse the json log format of the container logs you will need to push out the following to your indexers `transforms.conf`

```
[diamanti-container-logs]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
KV_MODE=none
SHOULD_LINEMERGE=true
category=Structured
description=JavaScript Object Notation format. For more information, visit http://json.org/
disabled=false
pulldown_type=true
```


## Things to keep in mind
The Docker json logging driver treats each line as a separate message. When using the Docker logging driver, there is no direct support for multi-line messages. You need to handle multi-line messages at the logging agent level or higher
{'fraction_non_alphanumeric': 0.06416899163013152, 'fraction_numerical': 0.00039856516540454366, 'mean_word_length': 4.976190476190476, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6564939', 'n_tokens_mistral': 684, 'n_tokens_neox': 639, 'n_words': 334}