https://community.splunk.com/t5/Getting-Data-In/journalctl-dhcpd-log-import/m-p/322539#M60082 <P>Perhaps try this as a scripted input. <BR /> Create an executable bash script with the command <STRONG>exec journalctl --since=now -f -u isc-dhcp-server</STRONG><BR /> Add the script as an input on the forwarder:<BR /> $SPLUNK_HOME/bin/splunk add exec \<BR /> -source $SPLUNK_HOME/bin/scripts/myScriptName.sh \<BR /> -interval = 0</P> Tue, 29 Sep 2020 16:23:06 GMT bguilfoyle_splu 2020-09-29T16:23:06Z https://community.splunk.com/t5/Getting-Data-In/journalctl-dhcpd-log-import/m-p/322538#M60081 <P>My linux-based DHCP server running ISC DHCPD is running systemd and puts the dhcpd logs into the central logging system without creating a distinct dhcpd.log file. Instead I have to look at the logs with this command:</P> <PRE><CODE>journalctl -u isc-dhcp-server </CODE></PRE> <P>So I can no longer simply point my UF to the old dhcpd.log file for import into Splunk. How can I get these logs into Splunk?</P> Sun, 22 Oct 2017 06:53:58 GMT https://community.splunk.com/t5/Getting-Data-In/journalctl-dhcpd-log-import/m-p/322538#M60081 splunkjosef 2017-10-22T06:53:58Z https://community.splunk.com/t5/Getting-Data-In/journalctl-dhcpd-log-import/m-p/322539#M60082 <P>Perhaps try this as a scripted input. <BR /> Create an executable bash script with the command <STRONG>exec journalctl --since=now -f -u isc-dhcp-server</STRONG><BR /> Add the script as an input on the forwarder:<BR /> $SPLUNK_HOME/bin/splunk add exec \<BR /> -source $SPLUNK_HOME/bin/scripts/myScriptName.sh \<BR /> -interval = 0</P> Tue, 29 Sep 2020 16:23:06 GMT https://community.splunk.com/t5/Getting-Data-In/journalctl-dhcpd-log-import/m-p/322539#M60082 bguilfoyle_splu 2020-09-29T16:23:06Z