https://community.splunk.com/t5/Monitoring-Splunk/splunk-search-head/m-p/687012#M10167 <P>thanks for the reply can you tell me how can i do that</P> Thu, 09 May 2024 10:52:59 GMT Siddharthnegi 2024-05-09T10:52:59Z https://community.splunk.com/t5/Monitoring-Splunk/splunk-search-head/m-p/687010#M10165 <P>Can i monitor a file in search head?</P> Thu, 09 May 2024 10:45:45 GMT https://community.splunk.com/t5/Monitoring-Splunk/splunk-search-head/m-p/687010#M10165 Siddharthnegi 2024-05-09T10:45:45Z https://community.splunk.com/t5/Monitoring-Splunk/splunk-search-head/m-p/687011#M10166 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/257462">@Siddharthnegi</a>,</P><P>yes, it's unusual (usual logs are read by Universal or Heavy Forwarders), but it's possible.</P><P>Remember that anyway, it's a best practice to forward all SH logs to the Indexers, so for this reason it's possible.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 09 May 2024 10:51:12 GMT https://community.splunk.com/t5/Monitoring-Splunk/splunk-search-head/m-p/687011#M10166 gcusello 2024-05-09T10:51:12Z https://community.splunk.com/t5/Monitoring-Splunk/splunk-search-head/m-p/687012#M10167 <P>thanks for the reply can you tell me how can i do that</P> Thu, 09 May 2024 10:52:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/splunk-search-head/m-p/687012#M10167 Siddharthnegi 2024-05-09T10:52:59Z