topic Universal Forwarder folder path monitor in Getting Data In

Universal Forwarder folder path monitor

sbattista09 — Tue, 26 Jan 2016 15:54:18 GMT

What stanza do i set in the Universal Forwarder to send data to the indexers from a folder path?
I want to send output from "/var/log/file.log" to the indexers in a new index called "IndexA".

Re: Universal Forwarder folder path monitor

skoelpin — Tue, 26 Jan 2016 16:00:59 GMT

Define your host

host = Your Hostname

[monitor:///var/log/file.log]
disabled = false
sourcetype = Your sourcetype
index = indexA

Re: Universal Forwarder folder path monitor

richgalloway — Tue, 26 Jan 2016 16:04:20 GMT

Try this:

[monitor:///var/log/file.log]
index = IndexA

Re: Universal Forwarder folder path monitor

sbattista09 — Tue, 26 Jan 2016 16:04:34 GMT

where would i set this in the Universal Forwarder?

Re: Universal Forwarder folder path monitor

skoelpin — Tue, 26 Jan 2016 16:05:50 GMT

It didn't save correctly, I edited my post and added the index part back into the Stanza.

Re: Universal Forwarder folder path monitor

skoelpin — Tue, 26 Jan 2016 16:11:23 GMT

If your on a linux box go to
/splunk/etc/system/local vi inputs.conf

If your on Windows then splunk\etc\system\local then open the inputs.conf and add the stanza

Don't forget to restart your Splunk service after making these changes

Re: Universal Forwarder folder path monitor

sbattista09 — Tue, 26 Jan 2016 17:29:12 GMT

they both work. Thank you all!