Hi
I have installed a 5.0.1 windows universal forwarder, and if i restart the uniforw. I get this message
Checking conf files for typos...
Possible typo in stanza [monitor:C:\Program Files\Application Prod\logs] in C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf, line 6: blacklist = \.zip$
There might be typos in your conf files. For more information, run 'splunk btool check --debug'
If I run a splunk list monitor, then all zip files are excluded from monitoring and it works as desired
This is the inputs.conf
[default]
host = server1
[monitor:C:\Program Files\Application Prod\logs]
disabled = false
blacklist = \.zip$
index = application
Is there anything wrong in this stanza config?
Thanks
Rob
It should say [monitor://c:\Program......etc.]
, i.e. you're missing the two slashes after monitor:
That's the only type I see.
/Kristian
It should say [monitor://c:\Program......etc.]
, i.e. you're missing the two slashes after monitor:
That's the only type I see.
/Kristian
Thanks, that was it