Put inputs.conf at /opt/splunkforwarder/etc/apps/search/local/.

# DEFAULT LOG

[monitor:///var/log/auth.log]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/secure]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/syslog]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/messages]
disabled = false
index = main
sourcetype = changeme

# APPS LOG

## NGINX

[monitor:///var/log/nginx/access.log]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/nginx/error.log]
disabled = false
index = main
sourcetype = changeme

## APACHE

[monitor:///var/log/apache2/access.log]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/apache2/error.log]
disabled = false
index = main
sourcetype = changeme

## HTTPd

[monitor:///var/log/httpd/access_log]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/httpd/error_log]
disabled = false
index = main
sourcetype = changeme


## HTTPd FreeBSD

[monitor:///var/log/httpd-access.log]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/httpd-error.log]
disabled = false
index = main
sourcetype = changeme

## Apache2 LibreNMS

[monitor:///opt/librenms/logs/access_log]
disabled = false
index = main
sourcetype = changeme

[monitor:///opt/librenms/logs/error_log]
disabled = false
index = main
sourcetype = changeme

## MYSQL

[monitor:///var/log/mysql/mysql.log]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/mysql/error.log]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/mariadb/mariadb.log]
disabled = false
index = main
sourcetype = changeme

# MALWARE LOG

[monitor:///var/log/rkhunter.log]
disabled = false
index = main
sourcetype = changeme

[monitor:///var/log/rkhunter/rkhunter.log]
disabled = false
index = main
sourcetype = changeme

# VA LOG

[monitor:///var/log/lynis.log]
disabled = false
index = main
sourcetype = changeme

# VIRUS LOG

[monitor:///var/log/clamscan.log]
disabled = false
index = main
sourcetype = changeme