https://community.splunk.com/t5/Getting-Data-In/Why-am-I-not-seeing-custom-logs-using-the-universal-forwarder/m-p/438885#M76512 <P>Hi pfabrizi,</P> <P>on the server running the universal forwarder, enter this URI into a webbrowser:</P> <PRE><CODE><A href="https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus" target="test_blank">https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus</A> </CODE></PRE> <P>username and password are the local Splunk universal forwarder ones (by default Splunk/changeme - or to whatever you did set it while install). Read more here : <A href="https://www.splunk.com/blog/2011/01/02/did-i-miss-christmas-2.html">https://www.splunk.com/blog/2011/01/02/did-i-miss-christmas-2.html</A></P> <P>If the events are monitored, good. Login to your Splunk Web UI and run an <CODE>all time</CODE> search on <CODE>index=wineventlog</CODE> it maybe that the timestamp is not recognised. If so, read here <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition">http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition</A></P> <P>If the events are not being monitored by the universal forwarder it might be a permission issue on the Windows box ...</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Sun, 15 Jul 2018 21:49:17 GMT MuS 2018-07-15T21:49:17Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-not-seeing-custom-logs-using-the-universal-forwarder/m-p/438884#M76511 <P>I am using the UF to try and collect logs from a custom windows application. Below is my inputs.conf stanza. How I am not seeing the logs. How can I see if they are getting collected and how can see if they are getting to the indexer?</P> <PRE><CODE>[WinEventLog://Quest File Access Audit] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 index = wineventlog renderXml=false </CODE></PRE> Sun, 15 Jul 2018 21:14:31 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-not-seeing-custom-logs-using-the-universal-forwarder/m-p/438884#M76511 pfabrizi 2018-07-15T21:14:31Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-not-seeing-custom-logs-using-the-universal-forwarder/m-p/438885#M76512 <P>Hi pfabrizi,</P> <P>on the server running the universal forwarder, enter this URI into a webbrowser:</P> <PRE><CODE><A href="https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus" target="test_blank">https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus</A> </CODE></PRE> <P>username and password are the local Splunk universal forwarder ones (by default Splunk/changeme - or to whatever you did set it while install). Read more here : <A href="https://www.splunk.com/blog/2011/01/02/did-i-miss-christmas-2.html">https://www.splunk.com/blog/2011/01/02/did-i-miss-christmas-2.html</A></P> <P>If the events are monitored, good. Login to your Splunk Web UI and run an <CODE>all time</CODE> search on <CODE>index=wineventlog</CODE> it maybe that the timestamp is not recognised. If so, read here <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition">http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition</A></P> <P>If the events are not being monitored by the universal forwarder it might be a permission issue on the Windows box ...</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Sun, 15 Jul 2018 21:49:17 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-not-seeing-custom-logs-using-the-universal-forwarder/m-p/438885#M76512 MuS 2018-07-15T21:49:17Z