Backup iTunes Purchased to an External Hard drive

Mar 20, 2009

Tutorial

0 Comments

I thought the easiest way to preserve my songs without deleting them would be to move them to an external hard drive. I searched online for an easy tutorial on how to do this, but I didn’t find any. I did a little playing around and I came up with my own solution which I’m going to share with you now.

Step 1: Select all purchased music.

Open up iTunes and select the “Purchased” playlist in the left-hand sidebar. Hit ⌘-A to select all of the songs. Alternatively, you can backup only a portion of these songs by selecting those specified songs.

IMG_4865

Select all in the purchased playlist.

Step 2: Drag and drop.

Open up your external hard drive and create a new folder. Drag and drop this selection from the iTunes window into this folder. A copy dialog will appear and your files will be on their way to the folder on the external hard drive.

Step 3: Voilá!

That’s it! Verify that the songs have been copied and you’re done! This should work with any version of iTunes, although I tried it in version 8.1. I hope this helps you as much as it helped me.

How to: Be an effective Gatekeeper

Feb 13, 2009

Essay· News· Tutorial

0 Comments

My first semester at LSU I took a class in public speaking. It was fairly trivial for me because I’m comfortable speaking in front of people and I’m also fairly good at speech craft. At first, I took the class as a joke—I originally raised serious contentions with my professor’s personality. I eventually came to realize the utility of the class and bonded with several of my classmates. It ended up being one of the best classes I took that semester—right behind calculus II—and the professor made a huge impact on me in a very important way.

Gatekeeping was a major highlight of that class. Gatekeeping is the process of limiting any given thing in some way. In public speaking, we talked about gatekeeping in the context of working in groups: Someone had to decide when enough information is enough. While this might seem like an unimportant job next to the leader, it’s actually quite imperative. The gatekeeper is the one who sorts through information coming in and decides which information is relevant and which isn’t. The gatekeeper is also the person who can cut off the flow of information to avoid information flooding. Because, at a certain point, too much information can be hazardous.

But gatekeeping is more than just something you’ll find in groups working on a project. It’s actually a process we use everyday, whether we recognize it or not. When you decide to read that New York Times article, when you decide not to watch that Onion video, when you decide to close your email program—that’s all gatekeeping. Each and every decision we make regarding the flow of information into our lives is gatekeeping. Some are quite good at it and, as a result, are very efficient, organized people. Some, however, are terrible at gatekeeping and thus become inundated with information and ultimately collapse. But the prognosis isn’t nearly as dire as it seems. You see, gatekeeping is actually really easy. So easy, in fact, that by the time you finish reading this article, you’ll be a veritable virtuoso of gatekeeping.

I became really good at gatekeeping when I left home and went to the Louisiana School for Math, Science and the Arts for the last two years of my high school career. LSMSA is one of the best high schools in the nation and, for many years, has been featured in Newsweek as a top-tier high school. It was hard—very hard; I was challenged beyond my breaking point. But I loved every minute of it. The problem, however, was balancing the arduous work load and my social media and constant connection addiction. It was never the information overload. One of my many talents is assimilation. I can absorb a massive amount of information everyday—and I read several hundred feeds constantly. The problem was balancing. I ultimately made some tough decisions: I shut down my blog, I limited myself to just Facebook and I wasn’t able to access the internet past midnight. But these decisions allowed me to keep my sanity—and graduate.

So, without further ado, here are my tips for becoming an effective gatekeeper.

  1. Decide what is relevant and what is not.
    Like I said, I subscribe to an incredible amount of RSS feeds. Combined, they probably publish over 500 stories a day—and that’s a conservative estimate. Do I read each and every story? No, of course not—who, besides John Gruber, has time for that? Instead, I scan each headline and, if something catches my attention, I skim it. If it proves to be a good article, I dedicate time to reading it. The problem is that there is a lot of really good information out there, and I want to read it all. But eliminating that which I don’t need helps keep my life in order. If I’m out of time and want to read an article, I don’t live it open in Safari. Having several tabs open at once can be deadly for productivity. Instead, file it away—into a GTD app or something similar—for later.
  2. Know your limits.
    Another pillar of gatekeeping is knowing your limits. I know that if I have only five minutes, I can’t finish a novel-sized article from the New York Times. I could speed-read it, yes, but not absorb it like I want. Instead, I’ll spend that time going through the less intellectual feeds I have—e.g. LOL cats or The Big Picture (which I highly recommend). The corollary to this is knowing your daily quota. How many articles can you safely read in one day? For some, it might be several hundred; for others it might be only a handful. You need to determine what your comfort level is and then stick to it.
  3. Make sacrifices.
    You have to be prepared to make sacrifices. Think about it: You only have 24 hours in your day. Between six and eight of those will be spent sleeping; another six to ten will be spent at work or school. That leaves between six and twelve hours to perform extra activities. If you’re going to fit everything into your day, you’re probably going to have to sacrifice something. More often than not, sleep is what I have to sacrifice—I think this is the blight of the contemporary intelligentsia. But activities aren’t the only thing you might have to sacrifice. For example, I sacrifice all knowledge of pop culture (amongst other things) to be a technological maven. I have a basic understanding of what is largely considered to be the reason for the degradation of Western Civilization, but I know more about current technology than I do pop culture. (I leave this to my sister, who is very good at that. It’s her thing and it’s quite remarkable how much she knows. While I don’t value that knowledge as much as others, it’s quite comparable to what I have. This makes us a dynamic team when doing crosswords: She knows all pop culture and I know everything else.) And I’m totally OK with that.
  4. Decompress.
    Everyday, I have about thirty minutes from the time I finish work and the time I eat dinner and begin my evening activities. I call this time my decompression period. It’s the time that I lay in my bed and do nothing—free from all distractions. I’ll just let my mind wander. This is really helpful because it allows me a break from the constant engagement that I put my mind through everyday. I think to be an effective gatekeeper, this is a vital step. Try it out. It’ll make your life more stress-free. It’s also just really interesting to see where your mind goes when you let it be a vagabond in its own cognition.

If you abide by these tips, you’ll be sure to avoid the eventual cranial meltdown that results from information overload. It’s something that is bound to happen with the ubiquity of information these days. Wonderful sites like Wikipedia have literally placed the sum of all human knowledge at our fingertips. Without effective gatekeeping, we’re all just a step away from a breakdown.

Are these steps useful to you? Do you already follow a fairly rigid system of gatekeeping—by another name or not? Or, is this the first you’ve ever heard of gatekeeping?

How to: Create an automatic News and Events Page with Google News

Feb 9, 2009

Tutorial

2 Comments

Introduction

The task was to create a central portal for news and events. The idea, of course, was to be easily maintainable. I thought about methods with which I could do this, and the easiest option came through aggregating information automatically—eliminating the need for human interaction all together. I took some code that was presented over at Think Vitamin for a Twitter microblog and modified it to take an Atom feed from Google News with a specific search query and present the results. I had to do some minor tweaking, so I’ll explain those below and then post the code for anyone else who’d like to use it.

Modifications to atom-html.php

Auto News and Events with Google News

Example Output


To make this script work, it requires a file called atom-html.php. It contains the function to take an Atom feed and parse it into HTML. There’s a block of code set off by comments from Ryan Carson of Think Vitamin. He made some adjustments to make the function work with the Twitter microblog they built for Think Vitamin. I only part of his code I kept was his method for printing each entry from the Atom feed as a <li>. Of course, it can be styled with CSS.

Because Google News’s feeds are really ugly and riddled with assorted HTML tags, I used PHP’s strip_tags function to rip out all of the unwanted tags—i.e., everything except for <a><li><p><br><b>. It automatically expunges all HTML tags from a given string. You can also pass it tags you’d like to keep, which I used to keep the above mentioned tags (they were there for formatting purposes).

I also used PHP’s str_replace function to make further adjustments. The items in the feed use a single “-” to separate the title of the publication and the date, so I replaced it with a “—”. In a few of the items, there were instances of improperly capitalized state postal abbreviations. I replaced these with their correct capitalized form using the same method. The
tag was one of the tags I allowed when using the strip_tags function. I did this because this is how the feed items were already formatted. However, there was a mysterious line breaks at the beginning of each item that was unnecessary and broke the layout. I use str_replace again to get rid of this
because it was popping up in a precise pattern. Otherwise, regex would’ve been more appropriate.

Here’s the code:

[code]
/**************************************************************************************************

Modified by Ryan Carson (ryan@carsonified.com)
Jan 20 2009

I've updated the way the HTML is outputt so that it's a simple list (

  • )

    Modified by Logan Leger (logan@loganleger.com)
    Feb 09 2009

    I removed the Twitter-specific code because we're not using it. I also stripped all the ugly html tags from the feeds that we don't need. I also fixed Ryan's non-closing

  • tag.

    **************************************************************************************************/

    # display a single entry as HTML
    function display_entry($data, $parent)
    {
    extract($data);
    if(!$TITLE) return;

    if($CONTENT) {
    $this->retval .= str_replace("

  • ","

  • ",str_replace(", la",", LA",str_replace("-","— ",strip_tags("

  • " . stripslashes($CONTENT) . "

  • \n\n",'

  • '))));
    } elseif($SUMMARY) {
    $this->retval .= "

  • " . stripslashes($SUMMARY) . "

  • \n\n";
    }

    }
    /**************************************************************************************************/
    /* End - Modified by Ryan Carson (ryan@carsonified.com) and Logan Leger (logan@loganleger.com) */
    /**************************************************************************************************/
    [/code]

    The PHP

    To use this code, simple pop the following into your webpage:

    [code]

      < ?php
      include('atom-html.php');
      $news = "http://news.google.com/news?hl=en&ned=tus&ie=UTF-8&q=%22baton+rouge%22&nolr=1&output=atom";
      $atom_parser = new myAtomParser($news);
      $output = $atom_parser->getOutput();
      echo $output;
      ?>

    [/code]

    And here’s the atom-html.php file.

    Conclusion

    Because we decided to use Google News and PHP to dynamically update this page, we don’t have to worry about missing a news story or spending time editing HTML files. It’s all done automatically when the page is accessed without any human interaction. It’s very quick and not CPU intensive—and there’s no database! This was just a quick scripting job, so I’m sure this can be done better. Do you have any suggestions? Have you used this for your site? Let me know.

    How to: Build and Extend a Wordpress Lifestream

    Dec 26, 2008

    Tutorial

    8 Comments

    Introduction

    Recently, I reinstalled Wordpress and began blogging again.  Initially, I didn’t add many plugins—just the basics.  Since then, I’ve gone back and added some very cool and important ones.  I’ll blog about the full list and my choices thereof later.  But now, I want to highlight one plugin: wp-Lifestream by iBegin.  It creates a simple “lifestream,” which is a stream of one’s activity across different social networks.  My lifestream can be viewed here.

    Wordpress Lifestream with wp-Lifestream Plugin

    Wordpress Lifestream with wp-Lifestream Plugin

    I looked into a couple different ways to create this lifestream, but this plugin offered the best option by far.  For one, it’s something that I didn’t have to build myself.  I could’ve easily rolled a solution using all of the APIs, but that’s kind of sloppy and certainly not elegant—at least not like this.  Secondly, it integrates with Wordpress and is fast and efficient.  Plus, I really liked the way it created the stream, so very few customization was necessary.  What also impressed me was its extensibility.  It has a built-in framework for adding new feeds.  I found that most of the websites I used were already included, but I came across two that weren’t included: Readernaut and ScrnShots.  I decided to dive right in and build these two plugins.  Since the documentation was kind of confusing—at least for me—I decided to write another step-by-step guide.  Each feed had a different solution, so I’ll walk you through each.  As my Christmas present to you, I’ve also included for download my feeds.inc.php file (this is the file we’ll be appending to activate these new sites) at the end of this post, which you are free to use.

    Note: I use the word “plugin” to refer to wp-Lifestream.  wp-Lifestream uses the word “plugin” to refer to the feed modules, which I refer to as extensions.  This seemed to be more apt and I hope this clarifies more than it confuses.

    Readernaut

    Introduction

    Readernaut is a social network for readers.  You can add books you’ve read, are reading, and want to read.  Moreover, you can make and share lists of books.  You can also make recommendations and interact within the community.  I think the succinct description on their homepage is the best: “Readernaut is my library, my notebook, my book club.”1  It’s currently in beta, but I highly recommend it for any avid reader.  You can sign up for an invite on their homepage.  If you’re a member, add me as a friend.

    Extension

    Readernaut offers a RSS feed to syndicate when you add a book to your library.  It’s formatted with the date, title of the book, and an image of the bookcover pulled from Amazon—this is my only complaint because it’s not always the exact book cover, but it’s close enough.  I decided that it was important to pull in the title of the book and not the cover, so I followed the documentation and examples of the other extensions.  The only advanced bit of this code is the username option.  Since Readernaut’s user feeds are predictable—unlike Facebook, for example—and since I knew that I’d be publishing it for the community, I added an option to take a username.  This just adds a field for the username on the page when you’re adding the feed.  These are all functions built into the framework and documented.  The comments are inline with the code.
    [code]
    class LifeStream_ReadernautFeed extends LifeStream_Feed {
    // This is just a unique ID that is used internally; make sure it doesn't conflict with others.
    const ID = 'readernaut';
    // The verbose name for your feed. This is what is displayed.
    const NAME = 'Readernaut';
    // An optional URL for more information about this feed. This is displayed on the page to add the feed.
    const URL = 'http://www.readernaut.com/';
    // A description for the feed, shown in the add feed and edit feed dialogs.
    const DESCRIPTION = 'Readernaut is my library, my notebook, my book club.';
    // The label for showing a single event. It follows the &amp;lt;a href="http://php.net/sprintf"&amp;gt;sprintf()&amp;lt;/a&amp;gt; format and parameters are: feed url, feed name
    const LABEL_SINGLE = 'Added a book to his collection on &amp;lt;a href="%s"&amp;gt;%s&amp;lt;/a&amp;gt;.';
    // The label for showing a group of events. It follows the &amp;lt;a href="http://php.net/sprintf"&amp;gt;sprintf()&amp;lt;/a&amp;gt; format and parameters are: number of items, feed url, feed name.
    const LABEL_PLURAL = 'Added books to his collection on &amp;lt;a href="%s"&amp;gt;%s&amp;lt;/a&amp;gt;.';
    // This is for a plural form of the label.
    function __toString() {
    return $this-&amp;gt;options['username'];
    }
    // This is what puts the form field for the username on the add feed page. This option is now available in subsequent lines. You can add other options as well.
    function get_options() {
    return array( 'username' =&amp;gt; array('Username:', true, '', ''), );
    }
    // This is an array of arrays that defines the options for this feed.
    function get_url() {
    return 'http://readernaut.com/rss/'.$this-&amp;gt;options['username'].'/books/';
    }
    // This is the actual URL that the information for the lifestream is pulled from. Like I said, the Readernaut RSS feeds are predictable so I could use the username option instead of asking for a feed URL. It's just much simpler.
    function get_public_url() {
    return 'http://readernaut.com/'.$this-&amp;gt;options['username'];
    }
    // This is the URL that is put to the lifestream for linking purposes. Again, I used the username option.
    }
    register_lifestream_feed('LifeStream_ReadernautFeed');
    // This is the last line of the extension and is what registers the extension with the plugin.
    [/code]
    The first step is to declare the class; the last step is to register the feed.  This is important.  Because of the nature of the feed and the information I wanted to pull from it, this is a relatively simple example.  I didn’t need to manipulate any of the data or switch any of the defaults.  One observation: you might want to change the gender of the entry to fit your needs.

    ScrnShots

    Introduction

    Scrnshots is a social network to share screenshots of design for inspiration.  You can either upload from your computer through the website or from their desktop application.  I use Paparazzi, a Mac utility for making images of webpages. It’ll take a screenshot of the entire page or you can specify a crop area. It even creates thumbnails for these shots. You can add me as a contact on ScrnShots here.

    Extension

    This one was slightly more complicated, mainly because of the poorly organized RSS feed, but also because of the information I wanted to pull from it—namely, the screenshot.  I ran into several road blocks.  First, I couldn’t determine the exact source of the images.  I figured out that they were hosted on Amazon S3 and I knew there were suffix options for determining size—e.g. large, full-sized, medium rectangular-sized, or small square-sized.  However, I couldn’t figure out the nomenclature for the image sources—there is a unique ID and a seemingly arbitrary description (is it the automatically generated or user generated?)  There was an API, but aside from documenting the suffix options, it didn’t help much.  Finally, I just resorted to using PHP’s built-in functions and some regular expressions to build around the—again, poorly formatted—RSS feed.  Here’s the code:
    [code]
    class LifeStream_ScrnShotsFeed extends LifeStream_PhotoFeed
    {
    // A unique ID for your feed. Must not conflict with any other feed plugins.
    const ID = 'scrnshots';
    // The verbose name for your feed.
    const NAME = 'Scrnshots';
    // An optional URL for more information about this feed.
    const URL = 'http://www.scrnshots.com/';
    // A description for the feed, shown in the add feed and edit feed dialogs.
    const DESCRIPTION = 'ScrnShots is the best way to take and share screenshots of web and screen based design. Upload as many screenshots as you want, embed them in your blog, discuss them with your contacts and become a better designer!';
    // The label for showing a single event. It follows the <a href="http://php.net/sprintf">sprintf()</a> format and parameters are: feed url, feed name
    const LABEL_SINGLE = 'Added a new screenshot to &amp;lt;a href="%s"&amp;gt;%s&amp;lt;/a&amp;gt;.';
    // The label for showing a group of events. It follows the <a href="http://php.net/sprintf">sprintf()</a> format and parameters are: number of items, feed url, feed name
    const LABEL_PLURAL = 'Added new screenshots to &amp;lt;a href="%s"&amp;gt;%s&amp;lt;/a&amp;gt;.';
    const LABEL_SINGLE_USER = '&amp;lt;a href="%s"&amp;gt;%s&amp;lt;/a&amp;gt;.' added a new screenshot to &amp;lt;a href="%s"&amp;gt;%s&amp;lt;/a&amp;gt;.';
    const LABEL_PLURAL_USER = '&amp;lt;a href="%s"&amp;gt;%s&amp;lt;/a&amp;gt;.' added new screenshots to &amp;lt;a href="%s"&amp;gt;%s&amp;lt;/a&amp;gt;.';
    function __toString() {
    return $this-&amp;gt;options['username'];
    }
    function get_options() {
    return array('username' =&amp;gt; array('Username:', true, '', ''),);
    }
    function get_url() {
    return 'http://scrnshots.com/users/'.$this-&amp;gt;options['username'].'/screenshots.rss';
    }
    function get_public_url() {
    return 'http://scrnshots.com/users/'.$this-&amp;gt;options['username'];
    }
    function yield($row) {
    $description = $row-&amp;gt;get_description();
    $title = strip_tags($description);
    $img = strip_tags($description,'&amp;lt;img&amp;gt;');
    $src = str_replace($title,'',$img);
    $large = preg_replace('/.*src=([\'"])((?:(?!\1).)*)\1.*/si','$2',$src);
    $small = str_replace('large','med_rect',$large);
    $arr = array(
    'title' =&amp;gt; strip_tags(html_entity_decode($row-&amp;gt;get_description())),
    'date' =&amp;gt; $row-&amp;gt;get_date('U'),
    'link' =&amp;gt; html_entity_decode($row-&amp;gt;get_link()),
    'thumbnail' =&amp;gt; $small,
    );
    return $arr;
    }
    }
    register_lifestream_feed('LifeStream_ScrnshotsFeed');
    [/code]
    Most of the code is the same as Readernaut’s, save two important pieces.  First, notice that the top says extend “PhotoFeed.”  This sets it up to take the screenshots and display them in the lifestream.  The last bit—function yield($row)—is what is returning the data to the plugin to be processed.  I didn’t have to do this with Readernaut because I didn’t need to override the default entry.  Each element in the array $arr is a property of the RSS feed.  To use this function, you must return at least date and link, but there are numerous options to chose from, including title and thumbnail—which you must return for PhotoFeed.  You return this entire array to the plugin to be written to the lifestream.  At the top is where I used some PHP magic to get the content from the RSS feed I wanted. Here’s the breakdown:

    $description = $row->get_description();

    This gets the description from the RSS feed.
    $title = strip_tags($description);

    By default, the plugin was writing the date I uploaded the screenshot to the lifestream.  This isn’t suitable—I wanted the description of the screenshot instead.  But, the description in the RSS feed was filled with other data—e.g. the HTML image source tag.  I used the PHP strip_tags() function to get rid of this tag, and all that’s left is the description.  One hurdle down.
    $img = strip_tags($description,'<img><img>');

    Here’s where some great stuff happens.  Like I said above, the image link is hidden within the description, so I need to strip everything else.  First, I took the description from the RSS feed and removed all of the HTML tags besides the image tag . . .
    $src = str_replace($title,'',$img);

    then I deleted the description that I already used . . .
    $large = preg_replace('/.*src=([\'"])((?:(?!\1).)*)\1.*/si','$2',$src);

    then I used some regular expression magic to delete the HTML image tags.  I can’t use strip_tags() because it also strips the content of the tags, which I need.
    $small = str_replace('large','med_rect',$large);

    Finally, I deleted the large suffix and added the suffix which yields the medium rectangular shape.  I also edited the _lifestream.php file, line 769, to make the width of the inline image bigger.  You can see the final result at my lifestream.

    Conclusion

    This plugin is very well written.  It covers nearly every social network and then includes a framework for extending it to those that it didn’t include.  I congratulate the writer and thank him for such a great plugin.  I highly recommend installing this plugin and it’s definitely on my top 10 list of Wordpress plugins—that article is in the works.  I hope these additions help you as they’ve helped me.  If you have any questions or can recommend a better way of doing this—I’m sure there is one—please leave a comment.

    As promised, here is my feeds.inc.php file which includes the above additions.

    Merry Christmas!

    How to: Introduction to Splunk Indexing

    Dec 23, 2008

    Tutorial

    3 Comments

    Introduction

    Splunk is IT search1: it allows searching and navigating of information—logs, configurations, messages, traps and alerts, scripts, code, metrics—from network devices.2  We use it at my place of employment for our system logs, amongst other things.  All servers, some devices, and now some applications send their logs to Splunk.  This gives us a unified search across our network, which is useful when diagnosing issues.  Another benefit to Splunk is the specificity of log viewing.  This is nice when you want to allow specific users or groups to view some logs but not have access directly to the host machines.  For example, a help desk might benefit from seeing a log, but you wouldn’t want them to have access directly to the machines.

    Recently, I was tasked with sending a new log to Splunk—the log from our custom web application that issues null routes.  The idea was that this would allow an extra layer of accountability.  I had a hard time finding easy, explicit instructions, so I thought the community would benefit from such documentation. So here it is: Logan Leger’s quick and easy five-step introduction to Splunk indexing.

    Step 1: Identify Log

    The first step to indexing in Splunk is to identify the log that you want to be indexed.  This might be a system log or, in my case, an application log.  For a system log in Unix, this should be in /var/log; for some versions of Windows, this will be in %SystemRoot%system32config.3  For sending Windows Event Logs to the syslogger, Ross Brown recommended evt2sys on Twitter. In a custom application, this will be where the programmer specified; review the code to find this.  In Unix using C, sending syslog data is usually accomplished using the syslog(3) family of functions4, which are included in libc.  In Perl, you can use the Sys::Syslog module.5

    Step 2: Send Log to Syslog

    Once you identify the log you want to send to Splunk, send it to the syslog daemon.  In Perl, you can use the Syslog extension.  Once the application is sending the log to the daemon, open up etc/syslog.conf and add the following:

    local0.*   /var/log/log.log.

    Change local0.* to whichever facility is available to you, just make sure that isn’t already chosen.  Also, change log.log to the actual name of your log.

    Step 3: Send Log to Splunk Daemon

    The next step is to send the log to the Splunk daemon.  To do this, append /etc/syslog.conf with the following:

    local0.*   @splunk.example.org.

    Again, make sure to change local0.* to whichever facility is available; this should be the same as above.  Change @splunk.example.org to the address of your Splunk installation.  Now, restart the syslog daemon with syslogd (/etc/rc.d/syslogd restart).

    Step 4: Add Log to Splunk Configuration

    Now that you’re sending the log to the syslog daemon and also sending it to Splunk remotely via the syslog daemon, it’s time to add it to the Splunk configuration.  Open up /etc/syslog.conf in your Splunk installation (this is the syslogd configuration and not Splunk-specific) and add the following line:

    local0.*   /var/log/remote/log.log.

    Once again, use the same facility from above and change log.log to the actual name of the log.  Now, restart the syslog daemon (/etc/rc.d/syslogd restart).

    Step 5: Add Log to Splunk Web Interface

    splunk_intro_indexing

    Splunk Admin Screenshot Showing How to Add a Log to Splunk (Click image to enlarge.)

    First, log in to the web interface as an administrator, and click on “Admin” in the top right-hand corner.  The Splunk logo in the top left should now say “Splunk>Admin.”  Click on “Data Inputs” and then “Files & Directories” under “Data Inputs” in the sidebar on the left.   Then, click the “New Input” button near the top-center.  Fill out the details in the form.  These will vary, but more than likely you will want to click the “Monitor a directory” radio button—Splunk works similar to the Unix tail -f command.  The “Full path on server” is the path to the remote log on the Splunk installation, taken from step 5—/var/log/remote/log.log.

    Troubleshooting

    I initially ran into some issues when sending the log to Splunk.  To test whether or not Splunk was actually receiving the data, Anthony, a coworker, recommended using the logger(1) command.6  Basically, we used the logger command to add our own data to the logs (absolute bogus data; it was just for testing purposes, but we knew exactly what we said and where it’d be).  This might come in handy if you run into issues.  We saw this bogus data show up in Splunk, so we knew it was sending data.  It turned out that we had internal problems in our application.

    Conclusion

    That’s it!  Your log should now show up in Splunk.  Play with the search to see if it is.  Keep in mind that you must allow the IP of any remote boxes through any firewalls.  Also, these instructions were written with Unix/FreeBSD in mind.  While most of this information might be similar, there will be some differentiation—e.g. syslogd, rc.d.  On the server-side, the syslog daemon is used to receive messages relayed by another remote syslog daemon.  This is completely independent of Splunk.  (There is an actual syslog protocol which was just recently standardized and extended, but it will be some time before we see the older implementations abdicating to the new protocol.)  If your setup has a central log server, this method should still work.

    I hope this helps alleviate any headache trudging through the Splunk documentation—it’s actually quite easy!

    [Many thanks to Anthony Illiopoulos for his significant input on this article.]