I'd like to monitor the MSSQL SQLERROR log file, for example i've turned on T1222 and want to get the deadlock output into splunk.
I think i'm just stumped on how to monitor the file named ERRORLOG (with no suffix.)
any tips?
ERRORLOG* worked for me - got both current/no extension and archived copies
ERRORLOG* worked for me - got both current/no extension and archived copies
Have you tried adding an input for the file path? You should be able to add it, by following this document:
http://www.splunk.com/base/Documentation/latest/admin/MonitorFilesAndDirectories
I believe the file will be located at %PROGRAMFILES%\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\ERRORLOG
Let me know if you run into any problems.
I know the input path to use, but the file inside that path has no extension which is causing my grief. I can't convince splunk to monitor it.