https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62171#M12427 <P>Hi anaptshah</P> <P>there are many things, that could prevent a file from being read by the universal forwarder:</P> <UL> <LI>file permission: does the user/service account which runs the splunkd have read access to this file?</LI> <LI>typo in the stanza: does <CODE>splunkd.exe list monitor</CODE> show your stanza with the correct path?</LI> <LI>maybe the file just does not get changed?</LI> <LI>did you restart your universal forwarder? it happened to me sometimes, that after the restart the file gets immediately read by splunk</LI> </UL> <P>hope this helps a bit and you get it fixed.</P> <P>cheers</P> Tue, 23 Aug 2011 05:45:41 GMT MuS 2011-08-23T05:45:41Z https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62170#M12426 <P>We are using SplunkUniversalForwarder 4.2.3 x64 to forward some logs. inputs.conf has the following stanzas</P> <P>[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs\CustomMSTRLog*] <BR /> disabled = 0 <BR /> sourcetype = stg_mstr_esm_log <BR /> crcSalt = <SOURCE></SOURCE></P> <P>[WinEventLog:Application]<BR /> disabled = 0</P> <P>[WinEventLog:System]<BR /> disabled = 0</P> <P>Eventlogs are getting forwarded without any issues but the apache logs are not. I am not seeing any errors in splunkd.log on the forwarder. </P> Mon, 28 Sep 2020 09:49:04 GMT https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62170#M12426 anantshah 2020-09-28T09:49:04Z https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62171#M12427 <P>Hi anaptshah</P> <P>there are many things, that could prevent a file from being read by the universal forwarder:</P> <UL> <LI>file permission: does the user/service account which runs the splunkd have read access to this file?</LI> <LI>typo in the stanza: does <CODE>splunkd.exe list monitor</CODE> show your stanza with the correct path?</LI> <LI>maybe the file just does not get changed?</LI> <LI>did you restart your universal forwarder? it happened to me sometimes, that after the restart the file gets immediately read by splunk</LI> </UL> <P>hope this helps a bit and you get it fixed.</P> <P>cheers</P> Tue, 23 Aug 2011 05:45:41 GMT https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62171#M12427 MuS 2011-08-23T05:45:41Z https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62172#M12428 <P>I uploaded the incorrect stanza, the stanza thats not working is as follows</P> <P>[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs\CustomMSTRLog*]<BR /> disabled = 0<BR /> sourcetype = stg_mstr_esm_log<BR /> crcSalt = <SOURCE></SOURCE></P> <P>splunkd.exe list monitor shows the directory but does not show any of the files. Is there something special about (x86)? The stanza on the original post works fine.</P> Mon, 28 Sep 2020 09:49:27 GMT https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62172#M12428 anantshah 2020-09-28T09:49:27Z https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62173#M12429 <P>I was able to resolve the issue using a whitelist. I think the wild card does not work because (x86) in the path.</P> <P>[monitor://D:\Program Files (x86)\MicroStrategy\Web Logs]<BR /> whitelist = Custom[^/]*.log$<BR /> disabled = 0<BR /> sourcetype = stg_mstr_esm_log<BR /> crcSalt = <SOURCE></SOURCE></P> Mon, 28 Sep 2020 09:49:29 GMT https://community.splunk.com/t5/Getting-Data-In/SplunkUniversalForwarder-not-forwarding-input-files/m-p/62173#M12429 anantshah 2020-09-28T09:49:29Z