topic Re: Why am I not seeing the logs in splunk GUI after configuring it in deployment servers? in Getting Data In

Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?

erwinpastor — Mon, 28 Sep 2020 18:13:42 GMT

I have configured the logs in the inputs.conf and added the servers in the serverclass.conf. Preliminary testing done to check if the client servers can connect to the splunk deployment server and communication port - all good.

output.conf looks like the following:

defaultGroup = zone1
disabled = false
[tcpout:zone1]
server = deploymentserver:9996,heavyforwarederserver:9996

[tcpout-server://deploymentserver:9996]
[tcpout-server://heavyforwarder:9996]

inputs.log looks like the following:

[monitor://D:\Program Files (x86)...\vCAC...\Logs*]
index = index_name
sourcetype = sourcetype_name

Additional info: servers have an existing WinEventlog and Perfmon setup in splunk.

For some reason, the changes are not being picked up the splunk GUI. Should there be any other config that needs to be done?

Re: Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?

hagjos43 — Thu, 20 Nov 2014 12:31:06 GMT

The inputs.conf file you are talking about above, is that the $splunk\etc\system\local\inputs.conf or $splunk\etc\apps\deployment....\inputs.conf?

Re: Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?

erwinpastor — Fri, 21 Nov 2014 02:19:27 GMT

the one in $splunk\etc\deployment....\inputs.conf

Re: Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?

hagjos43 — Fri, 21 Nov 2014 11:48:47 GMT

For one if the following syntax is what you actually have in your inputs.conf it is incorrect.
You have: [monitor://D:Program Files (x86)...vCAC...Logs*]
You should have: [monitor://D:\Program Files (x86)....vCAC....Logs.....*]

you were missing the "\" after the "D:"

Re: Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?

erwinpastor — Fri, 21 Nov 2014 14:01:14 GMT

Sorry, might have been omitted during the paste. But the actual syntaxt has "\" after the "D:". So it is [monitor://D:\Program Files (x86)\...\vCAC\...\Logs\*]

Re: Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?

hagjos43 — Fri, 21 Nov 2014 14:11:21 GMT

I've never tried to monitor a path with white spaces in the name. For testing purposes point it to a path with no spaces and see if you have any issues.

Re: Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?

erwinpastor — Fri, 21 Nov 2014 14:28:54 GMT

So the syntax should be like this [monitor://D:\Program*\...\vCAC\...\Logs\*] ? Will an asterisk (*) followed by ellipses (...) work in inputs.conf? Have you tried it before to monitor a path?

Re: Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?

erwinpastor — Tue, 25 Nov 2014 02:22:32 GMT

just tried doing without the spaces by editing the monitor to use Program* but unfortunately it still didn't work.
Any idea how Program Files or Program Files (x86) can be monitored in splunk?