Archive

How do I get my first log message?

New Member

I have setup Universal forwarder on my Windows Server 2016 machine.

I have setup the Universal forwarder credentials to point to my Splunk Cloud.

By default shouldn't I now be getting data from the splunkd.log file?

Regards,

Greg

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can always check your metrics.log on your Universal Forwarder installation to check whether data is being sent. Otherwise, you can of course search for index=_internal and also specify host=xyz if you'd like to.

The other Spluk logs are also monitored, not only the splunkd.log. 🙂

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You can always check your metrics.log on your Universal Forwarder installation to check whether data is being sent. Otherwise, you can of course search for index=_internal and also specify host=xyz if you'd like to.

The other Spluk logs are also monitored, not only the splunkd.log. 🙂

View solution in original post

0 Karma

New Member

index=_internal shows a number of records.
Some of the records show a host of WIN2016 which is the machine I'm monitoring but when I search on host=WIN2016 I get no results.

0 Karma

New Member

Data Summary shows: "Waiting for results..."

0 Karma

New Member

If I search:
index=_internal host=WIN2016

I get results so I guess internal events are filtered out by default.

0 Karma

SplunkTrust
SplunkTrust

Glad to hear you're receiving data. 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!