I want to collect logfiles in Splunk through the Universal Forwarder.
I've set up a forward for the logs of the eventviewer and that is working!
But now I've set up a forward for logs on a specific location C:\Test, but that's not working. (there are log-files in it of course)
What can be the reason? How can I check what's being wrong?
Hey DriesVloeberghen,
as someone who isn't into your config it would be helpful for me if you could post your inputs.conf of the UF.
I try to suggest some possible solutions to your problem.
[monitor://C:\Test]
[monitor://C:\Test\*]
[monitor://C:\Test.txt]
or you could do something like this
[monitor://C:\Test*]
Best regards,
pyro_wood
Ok thanks, it seems that the logfiles of yesterday are in. But then I've got 2 other questions.
- after how many time the files are uploaded?
- it seems that I have to search on: source="c:\test\test1.log" - How can I search on a folder?
Hey DriesVloeberghen,
as someone who isn't into your config it would be helpful for me if you could post your inputs.conf of the UF.
I try to suggest some possible solutions to your problem.
[monitor://C:\Test]
[monitor://C:\Test\*]
[monitor://C:\Test.txt]
or you could do something like this
[monitor://C:\Test*]
Best regards,
pyro_wood
Troubleshooting Monitor inputs can be troublesome it can usually be solved by inspecting the Splunkd.log, familiarity with btool and my favorite hit the rest endpoint on the forwarder to see the current status of the tailingprocessor.
Although this Wiki is old it has great information for troubleshooting monitor inputs:
http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs
Did you restart the forwarder?