topic Re: How to collect data from directories on remote machine into splunk indexer in Getting Data In

How to collect data from directories on remote machine into splunk indexer

sushma7 — Wed, 29 Jan 2014 09:09:17 GMT

Hi,

I have directories residing on D drive on my remote machine.

I have a splunk machine using which I need to collect the data from the directory on D drive on remote machine.

I had installed universal forwarder on the remote machine, but it does not help me to fetch out the information from D drive. I can fetch the data only from the eventlogs of remote machine.

Kindly help!

Thanks & Regards,
Sushma.

Re: How to collect data from directories on remote machine into splunk indexer

MuS — Wed, 29 Jan 2014 09:24:11 GMT

Hi sushma7,

best is to start reading the docs about Monitor files and directories and on edit inputs.conf. Remember this must all be done on your universal forwarder where your D drive exists.

hope this helps ...

cheers, MuS

Re: How to collect data from directories on remote machine into splunk indexer

sushma7 — Wed, 29 Jan 2014 09:38:00 GMT

Thanks for your information!

If i edit the inputs.conf file on the universal forwarder machine. Will I be able to view the D drive of remote machine from the main splunk machine i.e under Files and Directories- Add New option? Generally it shows the drives of the local machine right?

Regards,
Sushma.

Re: How to collect data from directories on remote machine into splunk indexer

MuS — Wed, 29 Jan 2014 09:46:54 GMT

yes, in the UI of the indexer you will only see the local directories and files. You must manually edit the inputs.conf on the remote universal forwarder, this tells the forwarder to monitor the data and forward it to the indexer. Nevertheless, you will still not see this D drive in your indexer UI 😉

Re: How to collect data from directories on remote machine into splunk indexer

sushma7 — Wed, 29 Jan 2014 14:06:34 GMT

As you have said, I had changed the inputs.conf file on the remote universal forwarder and here is what I did.
1)I want to monitor D:\Test\Testscripts (folder) on remote machine.
2) So i added the following lines on the E:\SplunkUniversalForwarder\etc\system\local\inputs.conf file. The lines are as follows:

[monitor://D:\Test\Testscripts]
disabled = false
sourcetype = access_combined

3) Then I logged into the main splunk instance, now I should be able to view the directory right? I am still facing issues. Still should I make anymore changes?

Can you correct me if i was wrong somewhere.

Re: How to collect data from directories on remote machine into splunk indexer

MuS — Wed, 29 Jan 2014 14:10:56 GMT

Did you restart the universal forwarder after the file change? Can the user running splunk access this directory? What is your issues?

Re: How to collect data from directories on remote machine into splunk indexer

sushma7 — Wed, 29 Jan 2014 14:26:06 GMT

I had restarted the forwarder service from services.msc
Then i logged into the main splunk instance and under the search and reporting app I ran the query sourcetpe = access_combined,because this is what I mentioned in the inputs.conf, but I could not view the data that I intended to monitor.

Re: How to collect data from directories on remote machine into splunk indexer

MuS — Wed, 29 Jan 2014 14:33:16 GMT

check 'index=_internal' for any message related to your universal forwarder

Re: How to collect data from directories on remote machine into splunk indexer

sushma7 — Wed, 29 Jan 2014 14:43:29 GMT

Yep I would, one more query, the directory that i mentioned in the inputs.conf is not a static one, the files in it gets updated for every 4 hours, so it would get updated in splunk as well right?

Re: How to collect data from directories on remote machine into splunk indexer

MuS — Wed, 29 Jan 2014 14:48:43 GMT

Yes if you monitor a directory Splunk will read everything in there if you did not set any black/whitelists which you did not 😉

Re: How to collect data from directories on remote machine into splunk indexer

sushma7 — Thu, 30 Jan 2014 06:33:28 GMT

Thanks for your support! It worked out....hurray!!!!!

Re: How to collect data from directories on remote machine into splunk indexer

MuS — Thu, 30 Jan 2014 07:30:30 GMT

You're welcome. Now you can show your support and accept the answer and/or upvote it 😉 thx 🙂