https://community.splunk.com/t5/Getting-Data-In/Why-is-my-universal-forwarder-on-Windows-server-2012-R2-not/m-p/278314#M53299 <P>I have a monitor that that isn't working. I turned debug on in log.cfg, and the Universal Forwarder reports no match on whitelist. The following has been tried: </P> <PRE><CODE>[monitor://E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles] disabled = false index = app_ops_prod whitelist=ReportServerService*.log sourcetype = mssql:ilink:rptsvrsvc ignoreOlderThan = 3d </CODE></PRE> <P>OR </P> <PRE><CODE>[monitor://E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles\ReportServerService*.log] disabled = false index = app_ops_prod sourcetype = mssql:ilink:rptsvrsvc ignoreOlderThan = 3d </CODE></PRE> <P>Splunkd.log says that is matches and then skips. As noted above, I tried 2 configurations. </P> <PRE><CODE>04-07-2016 17:34:20.348 +0000 DEBUG TailingProcessor - Item '' matches stanza: /E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles. 04-07-2016 17:34:20.348 +0000 DEBUG TailingProcessor - Not using stanza for this item (File did not match whitelist 'ReportServerService*.log'.). </CODE></PRE> <P>The file is <CODE>E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles\ReportServerService__test.log</CODE>. The host is Windows Server 2012 r2, and the UF is at verison 6.2.6. </P> Thu, 07 Apr 2016 18:10:29 GMT lisaac 2016-04-07T18:10:29Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-universal-forwarder-on-Windows-server-2012-R2-not/m-p/278314#M53299 <P>I have a monitor that that isn't working. I turned debug on in log.cfg, and the Universal Forwarder reports no match on whitelist. The following has been tried: </P> <PRE><CODE>[monitor://E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles] disabled = false index = app_ops_prod whitelist=ReportServerService*.log sourcetype = mssql:ilink:rptsvrsvc ignoreOlderThan = 3d </CODE></PRE> <P>OR </P> <PRE><CODE>[monitor://E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles\ReportServerService*.log] disabled = false index = app_ops_prod sourcetype = mssql:ilink:rptsvrsvc ignoreOlderThan = 3d </CODE></PRE> <P>Splunkd.log says that is matches and then skips. As noted above, I tried 2 configurations. </P> <PRE><CODE>04-07-2016 17:34:20.348 +0000 DEBUG TailingProcessor - Item '' matches stanza: /E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles. 04-07-2016 17:34:20.348 +0000 DEBUG TailingProcessor - Not using stanza for this item (File did not match whitelist 'ReportServerService*.log'.). </CODE></PRE> <P>The file is <CODE>E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles\ReportServerService__test.log</CODE>. The host is Windows Server 2012 r2, and the UF is at verison 6.2.6. </P> Thu, 07 Apr 2016 18:10:29 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-universal-forwarder-on-Windows-server-2012-R2-not/m-p/278314#M53299 lisaac 2016-04-07T18:10:29Z https://community.splunk.com/t5/Getting-Data-In/Why-is-my-universal-forwarder-on-Windows-server-2012-R2-not/m-p/278315#M53300 <P>Give this a try</P> <PRE><CODE>[monitor://E:\Program Files\Microsoft SQL Server\MSRS11.MSSQLSERVER\Reporting Services\LogFiles\] disabled = false index = app_ops_prod whitelist=ReportServerService.*\.log$ sourcetype = mssql:ilink:rptsvrsvc ignoreOlderThan = 3d </CODE></PRE> Fri, 08 Apr 2016 20:16:30 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-my-universal-forwarder-on-Windows-server-2012-R2-not/m-p/278315#M53300 somesoni2 2016-04-08T20:16:30Z