topic Re: splunk universal forwarder not pullng custom logs. in Getting Data In

splunk universal forwarder not pullng custom logs.

suryaaruna — Mon, 08 Jun 2020 22:16:41 GMT

Team,

I am having some windows servers which am able to get windows event logs, perfmons but the custom logs am not able to pull the same.

here is my inputs.conf configuration. i have checked the case sensitivity too as we got one situation wherein correction of case sensitivity didfix the issue. But in this case none is working for me.

[monitor:///D:\logfiles\ARBGlobal\SalesCoreApp\SaleCoreApp.log]
sourcetype = salescore
disabled = 0
ignoreOlderThan=7d

Request your help in fixing the issue.

Re: splunk universal forwarder not pullng custom logs.

gcusello — Mon, 30 Mar 2020 06:24:53 GMT

Hi òsuryaaruna,
you have to use only two slashes before path, not three, three is for Unix:

[monitor://D:\logfiles\ARBGlobal\SalesCoreApp\SaleCoreApp.log]

Ciao.
Giuseppe

Re: splunk universal forwarder not pullng custom logs.

suryaaruna — Mon, 30 Mar 2020 07:21:46 GMT

oh yes. thanks. it is two slashes. Thanks for your help.