not able to forward logs from a folder other then splunk and windows logs

ayushmangal14 — Tue, 23 Jun 2020 18:49:16 GMT

Hi All,

I am new to splunk. Just doing a POC.

So i have a splunk enterprise trial application which i am using for indexing and searching.

On same machine I have a universal forwarder. I am trying to forward the logs from UF to Inderxer.

When i am giving path to my syslog or splunk logs i can see logs in inderxer. Below is the input.conf -

[monitor:C:\Program Files\Splunk\var\log\splunk]
disabled = 0

But when i change it to some other folder for logs like -

[monitor:C:\test\testlogs]
disabled = 0

Its not forwarding any logs. I do have files in this location, those files are logs but not running logs.

Also Do i need to change only "etc\system\local" or "etc\apps\SplunkUniversalForwarder\local" also

topic not able to forward logs from a folder other then splunk and windows logs in Getting Data In