https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-universal-forwarder-on-a-syslog-server-to/m-p/250241#M48157 <P>you are going to need something like bellow </P> <P>[monitor:///logs/logsrc*/*.log]<BR /> host_segment = 2<BR /> sourcetype =locrc<BR /> index = test</P> <H1>ignoreOlderThan = 7d</H1> <P>disabled = false</P> <P>pay attention to line 2 where it take the folder name as host name otherwise it will make everyghing look like it is comming from the syslog server</P> <P>good luck</P> Tue, 29 Sep 2020 09:42:33 GMT mosman_splunk 2020-09-29T09:42:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-universal-forwarder-on-a-syslog-server-to/m-p/250240#M48156 <P>I am interested in configuring a universal forwarder on a syslog server, and have a question regarding how the log data is currently being written.</P> <P>There are multiple sources which forward log data to the syslog server. Each source is written to a directory structure similar to the following. As the date changes, a new directory is created beneath the logsrc directory.</P> <P>/logs/logsrc1/2016.05.09<BR /> messages<BR /> /logs/logsrc1/2016.05.10<BR /> messages<BR /> /logs/logsrc1/2016.05.11<BR /> messages</P> <P>/logs/logsrc2/2016.05.09<BR /> messages<BR /> /logs/logsrc2/2016.05.10<BR /> messages<BR /> /logs/logsrc2/2016.05.11<BR /> messages</P> <P>If each of the log sources is a similar data type, would the following inputs.conf entry correctly forward the data?</P> <PRE><CODE>[monitor:///logs/] index=sn_syslog sourcetype=sn_syslog recursive=true </CODE></PRE> Fri, 13 May 2016 16:39:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-universal-forwarder-on-a-syslog-server-to/m-p/250240#M48156 adamblock2 2016-05-13T16:39:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-universal-forwarder-on-a-syslog-server-to/m-p/250241#M48157 <P>you are going to need something like bellow </P> <P>[monitor:///logs/logsrc*/*.log]<BR /> host_segment = 2<BR /> sourcetype =locrc<BR /> index = test</P> <H1>ignoreOlderThan = 7d</H1> <P>disabled = false</P> <P>pay attention to line 2 where it take the folder name as host name otherwise it will make everyghing look like it is comming from the syslog server</P> <P>good luck</P> Tue, 29 Sep 2020 09:42:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-a-universal-forwarder-on-a-syslog-server-to/m-p/250241#M48157 mosman_splunk 2020-09-29T09:42:33Z