topic Monitoring the log files dynamically from universal forwarder to splunk indexer to specific index in Monitoring Splunk

Monitoring the log files dynamically from universal forwarder to splunk indexer to specific index

gaurav_a — Thu, 24 Nov 2011 05:20:54 GMT

Hi,
As I told you earlier, I used the command

./splunk add monitor directory-path -index index_name

But it having issue and I need to update my inputs.conf on the fly. so Is there any other way to add the monitor dynamically(like the above CLI command).
In the above case I am able to add the monitor but index parameter is throwing me an error.
It's a bit urgent for our project, please let us know the solution for the same.

Thanks in advance

Re: Monitoring the log files dynamically from universal forwarder to splunk indexer to specific index

sdwilkerson — Thu, 24 Nov 2011 05:38:49 GMT

gaurav_a,

The Splunk UF you are running this command from has a condition to test and ensure the index exists prior to routing your data there. This is probably the error you are seeing:

In handler 'monitor': Parameter index: Index 'foo1' does not exist. Please provide a valid index.

Here are a few options to do this quickly:

Use the Splunk DeploymentServer to change the path whenever you want. Note: setting up the DepoymentServer initially could take a little time.
Use a script to change the file at will either remotely or on a remote system

If you could articulate your use-case, I might have more ideas.

Best,
Sean

Re: Monitoring the log files dynamically from universal forwarder to splunk indexer to specific index

mic — Thu, 14 Mar 2013 09:33:36 GMT

In 4.3.3 and going forward, there is a parameter (check-index) that you can set to make this to happen without getting an error message complaining about the nonexistent index. By setting check-index to false, Universal Forwarder would not require the index to be there to begin with, but this is not the default behavior in 4.3.3.

For example:

./splunk add monitor /var/log/case1 -index test_case1 -check-index false

The default behavior is different depending on the version

4.3.3 universal forwarder: default check-index is true, which means that it would always check whether the index exists
4.3.4 universal forwarder: default check-index is true, which means that it would always check whether the index exists
4.3.5 universal forwarder: default check-index is true, which means that it would always check whether the index exists
5.0.2 universal forwarder: default check-index is false