topic Re: Inputs not working in Monitoring Splunk

Inputs not working

jgorman_THG — Tue, 21 Aug 2018 17:54:55 GMT

Hi,

I have the following input setup and it won't work. I cannot figure out what is wrong with it.

Any ideas?

Thanks,

[monitor:///C:\Program Files (x86)\Syslogd\Logs\SyslogCatchAll-192.15.0.2-2018-08-08.txt]
whitelist = *192.15.0.2*.txt|
host_regex=-(.*)-\d\d\d\d-\d\d-\d\d.txt 
sourcetype = meraki
index = Meraki
# ignoreOlderThan = 30d
disabled = false

Re: Inputs not working

horsefez — Tue, 21 Aug 2018 18:13:46 GMT

@jgorman_THG,
the problem could be that you use three / slashes in the monitor stanza.

Try this
[monitor://C:\Program Files (x86)\Syslogd\Logs\SyslogCatchAll-192.15.0.2-2018-08-08.txt]

Also... have you restarted splunk after configuring this?

Re: Inputs not working

horsefez — Wed, 22 Aug 2018 16:03:05 GMT

@jgorman_THG were you able to fix the problem?

Re: Inputs not working

jgorman_THG — Wed, 22 Aug 2018 16:25:20 GMT

Yup! that fixed it! I know it was something silly and small like that.