topic Re: How to configure universal forwarder on Linux to send a log file to Splunk heavy forwarder? in Getting Data In

How to configure universal forwarder on Linux to send a log file to Splunk heavy forwarder?

vnguyen46 — Thu, 20 Feb 2020 19:42:51 GMT

Hi,
I installed and configured UF on a Linux server to send syslog to Splunk HF. I am now trying to send an application log also on the same server, say it's in /opt/application/applog.log, to the HF. What I need to modify on the UF .conf file(s) ?

Thanks.

Re: How to configure universal forwarder on Linux to send a log file to Splunk heavy forwarder?

manjunathmeti — Thu, 20 Feb 2020 21:08:32 GMT

If universal forwarder is already connecting to heavy forwarder then you can just add a MONITOR input to forward applog.log in inputs.conf on UF.

[monitor:///opt/application/applog.log]
disabled = false
index = <index_name>
sourcetype = <sourcetype_name>
crcSalt =

Re: How to configure universal forwarder on Linux to send a log file to Splunk heavy forwarder?

vnguyen46 — Fri, 21 Feb 2020 15:39:20 GMT

Thank you.

Re: How to configure universal forwarder on Linux to send a log file to Splunk heavy forwarder?

manjunathmeti — Fri, 21 Feb 2020 20:00:45 GMT

you are welcome 🙂