topic Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk? in Monitoring Splunk

Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

alanxu — Tue, 30 Jun 2015 21:49:34 GMT

I want to create a folder on my desktop where I will hold log files for each day. Is there a way when a file is added to the directory it will automatically sync with my splunk database?

Thanks
Alan

EDIT: Got it to work. Thanks for all your help!

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

martin_mueller — Tue, 30 Jun 2015 21:56:23 GMT

Assuming your Splunk server is running on your local computer, all you need is an inputs.conf entry like this:

[monitor:///path/to/your/folder]
index = your_index
sourcetype = your_sourcetype

Splunk will then constantly index new lines added to files in that folder.

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

woodcock — Tue, 30 Jun 2015 21:59:20 GMT

Yes, edit $SPLUNK_HOME/etc/system/local/inputs.conf and add it like this:

[monitor://C:\users\*\desktop\splunkme\*]
index=main
sourcetype=constant_deskctop_sync

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

alanxu — Tue, 30 Jun 2015 22:03:14 GMT

Where will I be doing this?

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

alanxu — Tue, 30 Jun 2015 22:03:17 GMT

Where will I be doing this?

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

ChrisG — Tue, 30 Jun 2015 22:07:51 GMT

If you are new to the configuration file system, definitely read the documentation topics starting with About configuration files in the Admin Manual. You need to understand the directory structure and precedence.

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

woodcock — Tue, 30 Jun 2015 22:19:38 GMT

On your desktop server after you install Splunk there (which I thought you had already done).

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

alanxu — Thu, 02 Jul 2015 16:52:10 GMT

If Im doing it with Splunk web using localhost where would I find the config files?

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

martin_mueller — Thu, 02 Jul 2015 16:53:46 GMT

If you're on Windows, typically C:\Program Files\Splunk\etc.

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

alanxu — Thu, 02 Jul 2015 16:58:52 GMT

I found the inputs.config file... Right now all I have is the host = xxxxxxxxxxxxxxxxxx

And then I added your lines...
[monitor:\C:\Users......]
index=??
sourcetype=???

My sourcetype changes and what is index?

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

martin_mueller — Thu, 02 Jul 2015 17:52:19 GMT

This has an explanation of common keys used: http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Editinputs.conf

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

alanxu — Thu, 02 Jul 2015 17:56:34 GMT

I got it to work! Thanks

Re: Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

alanxu — Thu, 02 Jul 2015 17:57:30 GMT

Got it to work.. Thanks