Universal Forwarder Syntax for Inputs.conf

fongkh76 — Thu, 03 May 2012 06:22:37 GMT

Hi,

I am new to Splunk and have just configured a universal forwarder on a remote windows server in order to forward all log files under a specified folder to the receiver

However I am not able to see the logs being piped to the receiver.

My settings for "inputs.conf" as follows:

[Monitor://\\program files\syslogd\logs] 

 Disable=0

Any help is appreciated

Thank you

Re: Universal Forwarder Syntax for Inputs.conf

MarioM — Thu, 03 May 2012 06:34:39 GMT

I am not sure if it's typo in your post but the syntax should be:

[monitor://c:\program files\syslogd\logs]
disabled=false

Re: Universal Forwarder Syntax for Inputs.conf

kristian_kolb — Thu, 03 May 2012 08:08:00 GMT

Make sure your outputs.conf is correctly configured, as well.

Re: Universal Forwarder Syntax for Inputs.conf

fongkh76 — Thu, 03 May 2012 08:47:58 GMT

Thank you so much. It worked perfect with your advised syntax

Re: Universal Forwarder Syntax for Inputs.conf

MarioM — Thu, 03 May 2012 09:01:26 GMT

you welcome! then accept the answer for others looking at same issue,thanks!

Re: Universal Forwarder Syntax for Inputs.conf

fongkh76 — Thu, 03 May 2012 09:13:30 GMT

how do i accept the answer ?

Re: Universal Forwarder Syntax for Inputs.conf

MarioM — Thu, 03 May 2012 09:52:27 GMT

on the left side of the answer and below the answer (before comments)

Re: Universal Forwarder Syntax for Inputs.conf

hokie1999 — Mon, 28 Sep 2020 13:55:10 GMT

Splunk.com
Documentation
Splunkbase
Answers
Wiki
Blogs
Developers

Sign UpLogin FAQ

HomeAnswersAppsuserstagsbadgesask a questionupload an app

Universal Forwarder Syntax for Inputs.conf

Hi, I am new to Splunk and have just configured a universal forwarder on a remote windows server in order to forward all log files under a specified folder to the receiver However I am not able to see the logs being piped to the receiver. My settings for "inputs.conf" as follows: [Monitor://\program files\syslogd\logs]

Disable=0
Any help is appreciated Thank you
inputsconf

asked 02 May '12, 23:22

fongkh76
11
accept rate:0%

edited 02 May '12, 23:40

Ayn
24.7k●3●7●17

Make sure your outputs.conf is correctly configured, as well. /k
(03 May '12, 01:08)kristian.kolb

One Answer:

oldestnewestmost voted

I am not sure if it's typo in your post but the syntax should be: [monitor://c:\program files\syslogd\logs]
disabled=false

link

answered 02 May '12, 23:34

MarioM
2.7k●4●7
accept rate:20%

Thank you so much. It worked perfect with your advised syntax
(03 May '12, 01:47)fongkh76

you welcome! then accept the answer for others looking at same issue,thanks!
(03 May '12, 02:01)MarioM

how do i accept the answer ?
(03 May '12, 02:13)fongkh76

on the left side of the answer and below the answer (before comments)
(03 May '12, 02:52)MarioM

Post your answer

Same problem; logs not being forwarded from a Windows server to pair of indexers. See configs below. A restart of a service "InterraBaton" on the monitored server does not show up on the Splunk via the search head but does show up in the logs on the IB server. Any ideas would b appreciated.

inputs.conf

[default]
index = default
_rcvbuf = 1572864
host = DDCIBVERMGR02
evt_resolve_ad_obj = 0
evt_dc_name=
evt_dns_name=

.
.
.

[monitor://C:\batonSites\VerificationManager\log] <<< log 1
disabled = 1
[monitor://C:\batonSites\Workers\log] <<< log 2
disabled = 1

outputs.conf

[tcpout]
maxQueueSize = 500KB
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = _audit
forwardedindex.filter.disable = false
indexAndForward = false
autoLBFrequency = 30
blockOnCloning = true
compressed = false
disabled = false
dropClonedEventsOnQueueFull = 5
dropEventsOnQueueFull = -1
heartbeatFrequency = 30
maxFailuresPerInterval = 2
secsInFailureInterval = 1
maxConnectionsPerIndexer = 2
forceTimebasedAutoLB = false
sendCookedData = true
connectionTimeout = 20
readTimeout = 300
writeTimeout = 300
useACK = true

defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = XXX.YYY.138.158:9997,XXX.YYY.138.159:9997

[tcpout-server://XXX.YYY.138.158:9997]

[hide preview]

1324 characters / 164 words

inputs.conf

[default] index = default rcvbuf = 1572864 host = DDCIBVERMGR02 evtresolveadobj = 0 evtdcname= evtdnsname=

. . .

[monitor://C:\batonSites\VerificationManager\log] <<< log 1 disabled = 1 [monitor://C:\batonSites\Workers\log] <<< log 2 disabled = 1

outputs.conf

[tcpout] maxQueueSize = 500KB forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = _.* forwardedindex.2.whitelist = _audit forwardedindex.filter.disable = false indexAndForward = false autoLBFrequency = 30 blockOnCloning = true compressed = false disabled = false dropClonedEventsOnQueueFull = 5 dropEventsOnQueueFull = -1 heartbeatFrequency = 30 maxFailuresPerInterval = 2 secsInFailureInterval = 1 maxConnectionsPerIndexer = 2 forceTimebasedAutoLB = false sendCookedData = true connectionTimeout = 20 readTimeout = 300 writeTimeout = 300 useACK = true

defaultGroup = default-autolb-group

[tcpout:default-autolb-group] server = XXX.YYY.138.158:9997,XXX.YYY.138.159:9997

[tcpout-server://XXX.YYY.138.158:9997]

Privacy & Terms

0
inShare.

Follow this question
Email:
Log In to enable email subscriptions
RSS:
Answers

Answers + Comments

•
•
•
•
•
•
•

Tags:

inputs
conf

Asked: 02 May '12, 23:22

Seen: 799 times

Last updated: 03 May '12, 02:52

Re: Universal Forwarder Syntax for Inputs.conf

hokie1999 — Thu, 16 May 2013 16:05:19 GMT

Correction, inputs.conf has this:

[monitor://C:batonSites\VerificationManager\log]
disabled = 1
[monitor://C:batonSites\Workers\log]
disabled = 1

topic Re: Universal Forwarder Syntax for Inputs.conf in Getting Data In

Universal Forwarder Syntax for Inputs.conf

Re: Universal Forwarder Syntax for Inputs.conf

Re: Universal Forwarder Syntax for Inputs.conf

Re: Universal Forwarder Syntax for Inputs.conf

Re: Universal Forwarder Syntax for Inputs.conf

Re: Universal Forwarder Syntax for Inputs.conf

Re: Universal Forwarder Syntax for Inputs.conf

Re: Universal Forwarder Syntax for Inputs.conf

inputs.conf

outputs.conf

Re: Universal Forwarder Syntax for Inputs.conf