Can universal forwarders detect and forward newly created logs

suhprano — Fri, 15 Apr 2011 01:05:47 GMT

Can Splunk universal forwarders handle and forward newly created log files? I would like to forward data as raw logs to a remote server and not a splunk indexer using the splunk forwarder, but is it smart enough to trigger upon file creation?

Re: Can universal forwarders detect and forward newly created logs

piebob — Fri, 15 Apr 2011 02:02:52 GMT

if you specify a directory in the inputs.conf being used by the forwarder in question, and the log file is created in that directory, it will get forwarded automatically.

for details about how Splunk monitors files and directories: http://www.splunk.com/base/Documentation/latest/Data/Monitorfilesanddirectories

details on how forwarders can get data: http://www.splunk.com/base/Documentation/latest/Data/Usingforwardingagents

i missed that you were talking about forwarding to a third-party (not splunk) host, here is the info for that:

http://www.splunk.com/base/Documentation/latest/Deploy/Forwarddatatothird-partysystemsd

topic Can universal forwarders detect and forward newly created logs in Getting Data In

Can universal forwarders detect and forward newly created logs

Re: Can universal forwarders detect and forward newly created logs