topic Monitor DHCP Logs Via Wildcard? in Getting Data In

Monitor DHCP Logs Via Wildcard?

dscoland — Wed, 09 Jul 2014 15:47:18 GMT

Hi Splunk Community,

I am currently running Splunk 6.1.0 on Windows Server 2008 R2.

My goal is to monitor our DHCP logs from our Windows-based domain controllers, and have the universal forwarders forward the DHCP logs to our heavy forwarder that then filters/parsers and forwards these to our central Splunk instance.

I have the following monitor stanza set up in $SPLUNK_HOME$/UniversalForwarder/etc/system/local

[monitor:://C:\Windows\ System32\Dhcp\ DhcpSrvLog*.txt]
disabled = 0
sourcetype = dhcp
host = splunkhf1:9997

From what I have been reading, these wildcard path should work, but we are not getting any data.

Is this type of wildcard path not supported?

Thank you in advance,
Daniel

Re: Monitor DHCP Logs Via Wildcard?

dshpritz — Wed, 09 Jul 2014 16:36:13 GMT

Hey dscoland,

From looking at the Splunk Add-on for Microsoft Windows it has a default input that looks like this:

[monitor://$WINDIR\System32\DHCP]
disabled = 1
whitelist = DhcpSrvLog*
crcSalt = <SOURCE>
sourcetype = DhcpSrvLog

You could use that, or use the add-on to gather that data. Note that the add-on also contains parsing (props/transforms) for that sourcetype, so you may want to look into using it.

Re: Monitor DHCP Logs Via Wildcard?

dscoland — Wed, 09 Jul 2014 16:38:34 GMT

Do these have to be enabled on all of the Universal Forwarders?

Re: Monitor DHCP Logs Via Wildcard?

dshpritz — Wed, 09 Jul 2014 16:47:42 GMT

It doesn't have to be on all of them, just the DHCP servers.

Re: Monitor DHCP Logs Via Wildcard?

dscoland — Wed, 09 Jul 2014 17:13:43 GMT

Nice, it worked! Thank you.