topic Universal Forwarder - Add another Log FIle to Index in Getting Data In

Universal Forwarder - Add another Log FIle to Index

pgergen — Mon, 24 Oct 2011 05:18:24 GMT

I have a Linux Splunk Indexer.

How do I add another log file to be indexed by Splunk to the Universal Forwarder on a Windows Server ?

Many Thanks

Regards
Peta Gergen
peta.gergen@team.telstra.com

Re: Universal Forwarder - Add another Log FIle to Index

Ayn — Mon, 24 Oct 2011 06:54:34 GMT

There's a whole manual covering these topics in the docs. This should be a good place to start: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs

Long story short: either use the CLI or add a directive in in an inputs.conf file (for instance in $SPLUNK_HOME/etc/system/local).

CLI: $SPLUNK_HOME/bin/splunk add monitor <logdir>

inputs.conf: [monitor:///<logdir>]

Re: Universal Forwarder - Add another Log FIle to Index

lalit_mohan — Wed, 13 Nov 2013 14:49:15 GMT

Hi Guys,

I have similar problem!!!

I have two instances one is splunk-server and other is splunk-forwarder(universalForwarder).
Everything is fine with configuration ,then I tried to monitor tomcat logs and I have perform below steps on forwarder.

/usr/share/splunk_setup/splunkforwarder/bin/splunk add monitor /usr/share/apache-tomcat-7.0.42/logs/catalina.out -index default -sourcetype log4j -hostname splunkforwarder

But in search tab of splunk-web I always get No results found.

Am I missing something !!!.Please help me out.
Thanks in advance!!