topic Re: Splunk - Universal forwarder in Getting Data In

Splunk - Universal forwarder

macwin — Thu, 18 Oct 2012 18:03:20 GMT

How can I define a custom source type with in universal forwarder so that it can be seen in splunk indexer?

Re: Splunk - Universal forwarder

alacercogitatus — Thu, 18 Oct 2012 18:18:19 GMT

You will want to set that on the input.

Example:

[monitor:///var/log/syslog] sourcetype = MY_SOURCETYPE disabled = false

http://www.splunk.com/base/Documentation/5.0/Admin/Inputsconf

Re: Splunk - Universal forwarder

macwin — Thu, 18 Oct 2012 18:43:22 GMT

It does not work. Do I need to check in any other location?

Re: Splunk - Universal forwarder

alacercogitatus — Thu, 18 Oct 2012 18:50:01 GMT

What file are you putting that in? Could you post the input configuration please? Thanks!

Re: Splunk - Universal forwarder

macwin — Thu, 18 Oct 2012 18:55:24 GMT

I have installed windows splunk forwarder.Splunk indexer is on some other machine altogether. Then in \etc\system\local created a file called input.conf. The conetent of the file is :

[monitor://C:\testlogs]
sourcetype = ForwarderSourceType
source = ForwarderSource
disabled = false

Restarted forwarder and splunk indexer. But this entry is not coming in splunk indexer.

Re: Splunk - Universal forwarder

alacercogitatus — Thu, 18 Oct 2012 18:58:12 GMT

Do you have outputs configured to send the data to the indexer? Also, the file name is inputs.conf that should go in that folder. make sure you have the s in there.

Re: Splunk - Universal forwarder

macwin — Thu, 18 Oct 2012 19:00:25 GMT

The thing is, I can see the logs under automated sourcetype. I want to get these logs under my sourcetype.

output.conf file has all the necessary contents as I can see logs remotely.