Splunk Dev

Where is my monitor stanza?

aanataliya
Explorer

I have added monitoring with below command on my windows client.

./splunk add monitor C:\path\to.log -index qa -sourcetype pcs_log -host <ip>

I can see above path in monitored file list when I execute splunk list monitor.

As per my understanding splunk add monitor adds below stanza in inputs.conf. Isn't it? But I am unable to find these lines in any of inputs.conf file. I have checked /etc/system/local/inputs.conf but it doesnt have these values.

[monitor://path/to.log]
disabled = 0
setting1 = value
setting2 = value
...

I am using splunk cloud and installed universal forwarder. can you please help?

Tags (1)
0 Karma

aivarson_splunk
Splunk Employee
Splunk Employee

When you add a monitor from the CLI it goes to the search app, local, inputs config. $SPLUNK_HOME\etc\apps\search\local\inputs.conf

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@aanataliya

The inputs.conf could be created under your app also. Easy way to find is using btool

./splunk cmd btool inputs list --debug | grep 'your known string'
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...