topic Re: WIndows Splunk Forwarder in Getting Data In

WIndows Splunk Forwarder

macwin — Wed, 17 Oct 2012 13:56:31 GMT

Currently, during the installation of splunk forwarder, at one place it takes input of the directory path or file path of the log file to be indexed. Suppose my log files are in 2 different directories. How can I use both of them for indexing?

Thanks.

Re: WIndows Splunk Forwarder

sdaniels — Wed, 17 Oct 2012 14:20:53 GMT

Are you asking how you'd set up your splunk forwarder to monitor multiple files that happen to exist in different directories on the same server? In inputs.conf you would just have two entries like this:

[monitor://C:\somedirectory\anotherone\test.log]
index = myindex
sourcetype = mysourcetype

[monitor://C:\mydirectory\somethingelse\file.log]
index = myindex
sourcetype = mysourcetype

Re: WIndows Splunk Forwarder

macwin — Wed, 17 Oct 2012 14:49:59 GMT

Thanks. I dont have this entry for the file I am currently indexing, then also I can read it.

Re: WIndows Splunk Forwarder

sdaniels — Wed, 17 Oct 2012 14:52:46 GMT

If you do this through the Splunk UI it will create that inputs.con file for you in \etc\system\local. If you want to do it manually in the config file just create the file yourself add the appropriate settings after looking in our docs and restart splunk on the forwarder.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs