I have a Windows server 2003 which forwards data to Splunk instance on a Linux box. I want the file c:\Program Files(x86)\SSRPM\Service\Logging\SSRPMLog.log (which is there on the Windows forwarder) to be monitored on Splunk.
How to do this?
The way i understood it from the docs:
I placed the above entry in
but its not getting indexed on the Splunk instance.
sounds to me like you have not yet set up forwarding... try that first, and if so, try pasting the whole inputs.conf as well as your outputs.conf. Also make sure your indexer is set up to receive events.
First you need to verify that the Splunk instance on the Windows Server is forwarding to the Linux box. Once you verify that, then you can modify your inputs.conf on the Windows Server to accept the new file input. Once you restart the Forwarder, it should begin streaming data to the Splunk indexer. There are multiple questions and answers regarding troubleshooting of Splunk Forwarders, which you should review. Some common remedies for your symptoms include setting the correct index (existing on the Splunk indexer) and setting up the forwarder topology properly.