topic Re: Help configuring forwarder on Windows 2008R2 for DHCP & RADIUS logs in Deployment Architecture

Help configuring forwarder on Windows 2008R2 for DHCP & RADIUS logs

Sparky70 — Mon, 28 Sep 2020 17:17:26 GMT

I am attempting to add the DHCP and RADIUS logs on a server installed with the Splunk Forwarder.

I have the following configured within C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\input.conf and restarted the forwarder service.

###### DHCP ######
[monitor://C:\Windows\System32\DHCP]
disabled = false
whitelist = Dhcp*.log
crcSalt = <SOURCE>
sourcetype = Dhcp
alwaysOpenFile = 1

###### RADIUS ######
[monitor://C:\Windows\System32\LogFiles]
disabled = false
whitelist = IN*.log
crcSalt = <SOURCE>
sourcetype = RADIUS
alwaysOpenFile = 1

I cannot see any of that data within Splunk. What am I missing?

Re: Help configuring forwarder on Windows 2008R2 for DHCP & RADIUS logs

jstrandman — Tue, 23 Dec 2014 08:34:03 GMT

You might still have an other inputs.cong file taking precedence over the one you listed above. Check /system/local and any other apps.

Re: Help configuring forwarder on Windows 2008R2 for DHCP & RADIUS logs

satishsdange — Tue, 23 Dec 2014 16:14:58 GMT

make disabled = 0 & see the results.

Re: Help configuring forwarder on Windows 2008R2 for DHCP & RADIUS logs

phuongnst — Thu, 01 Mar 2018 07:42:01 GMT

Just this command in input.conf

DHCP

[monitor://C:\Windows\System32\DHCP\Dhcp*.log]
disabled = 0