topic Re: Monitoring a file in windows forwarder on Splunk instance on Linux in Monitoring Splunk

Monitoring a file in windows forwarder on Splunk instance on Linux

achouras — Mon, 05 Jul 2010 19:48:35 GMT

Hi, I have a Windows server 2003 which forwards data to Splunk instance on a Linux box. I want the file c:\Program Files(x86)\SSRPM\Service\Logging\SSRPMLog.log (which is there on the Windows forwarder) to be monitored on Splunk.

How to do this?

The way i understood it from the docs: [monitor:c:\Program Files(x86)\SSRPM\Service\Logging\SSRPMLog.log]

I placed the above entry in c:\Program files\Splunk\etc\system\local\inputs.conf

but its not getting indexed on the Splunk instance.

Please help.

Regards, Abhishek

Re: Monitoring a file in windows forwarder on Splunk instance on Linux

Simeon — Tue, 06 Jul 2010 00:34:52 GMT

First you need to verify that the Splunk instance on the Windows Server is forwarding to the Linux box. Once you verify that, then you can modify your inputs.conf on the Windows Server to accept the new file input. Once you restart the Forwarder, it should begin streaming data to the Splunk indexer. There are multiple questions and answers regarding troubleshooting of Splunk Forwarders, which you should review. Some common remedies for your symptoms include setting the correct index (existing on the Splunk indexer) and setting up the forwarder topology properly.

Re: Monitoring a file in windows forwarder on Splunk instance on Linux

Genti — Tue, 14 Sep 2010 06:35:37 GMT

sounds to me like you have not yet set up forwarding... try that first, and if so, try pasting the whole inputs.conf as well as your outputs.conf. Also make sure your indexer is set up to receive events.

Re: Monitoring a file in windows forwarder on Splunk instance on Linux

tgow — Tue, 01 Feb 2011 22:04:59 GMT

Hi Ahishek,

You can set the data input via either the Web UI, command line or by editing config files. If you have set the Windows2003 server as a light forwarder then you will have to use the command line.

Instructions to setup the data input via the Web UI are here:

http://www.splunk.com/base/Documentation/4.1.6/User/Adddatatutorial

If you want to add a data input via the command line then use the following:

%SPLUNK_HOME%\bin\splunk add monitor C:\Program Files(x86)\SSRPM\Service\Logging\SSRPMLog.log

If you want to add the data source via a config file then you need to modify the following file:

%SPLUNK_HOME%\etc\system\local\inputs.conf

with the following:

[monitor://c:\Program Files(x86)\SSRPM\Service\Logging\SSRPMLog.log] disabled = false followTail = 0

You shouldn't have to restart the forwarder. The file needs to have data in it for you to see the forwarder and source on the indexer's summary search page.

Hope that helps.