https://community.splunk.com/t5/Getting-Data-In/add-log-file-to-splunk-universal-forwarder/m-p/116684#M24339 <P>The splunkd.log is most likely already being sent by the forwarder but you may not be searching the internal indexes by default.</P> <P>Try this search:<BR /> index=_internal source="/opt/splunkforwarder/var/log/splunk/splunkd.log" host=hostname</P> Wed, 02 Apr 2014 16:58:19 GMT rkirkw 2014-04-02T16:58:19Z https://community.splunk.com/t5/Getting-Data-In/add-log-file-to-splunk-universal-forwarder/m-p/116682#M24337 <P>I'm trying to monitor a log file to a splunk universal forwarder. For example the splunkd.log file. I've tried getting into the inputs.conf file on the machine with the universal forwarder intstalled and adding [monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]. I can't see the log file on the main reciever. What am I missing here? Please help....</P> Wed, 02 Apr 2014 16:08:01 GMT https://community.splunk.com/t5/Getting-Data-In/add-log-file-to-splunk-universal-forwarder/m-p/116682#M24337 jszyba 2014-04-02T16:08:01Z https://community.splunk.com/t5/Getting-Data-In/add-log-file-to-splunk-universal-forwarder/m-p/116683#M24338 <P>That file should be monitored automatically, search the <CODE>_internal</CODE> index for it.</P> Wed, 02 Apr 2014 16:48:29 GMT https://community.splunk.com/t5/Getting-Data-In/add-log-file-to-splunk-universal-forwarder/m-p/116683#M24338 martin_mueller 2014-04-02T16:48:29Z https://community.splunk.com/t5/Getting-Data-In/add-log-file-to-splunk-universal-forwarder/m-p/116684#M24339 <P>The splunkd.log is most likely already being sent by the forwarder but you may not be searching the internal indexes by default.</P> <P>Try this search:<BR /> index=_internal source="/opt/splunkforwarder/var/log/splunk/splunkd.log" host=hostname</P> Wed, 02 Apr 2014 16:58:19 GMT https://community.splunk.com/t5/Getting-Data-In/add-log-file-to-splunk-universal-forwarder/m-p/116684#M24339 rkirkw 2014-04-02T16:58:19Z