Hi
i have a Universal Fowarder with the following monitor stanza's in it.
[monitor:///project/logs1/]
blacklist = .(gz)$
whitelist = perflog.txt$
followTail = 0
recursive = false
sourcetype = perflogs
index = projectlogs
[monitor:///project/logs2/]
blacklist = .(gz)$
whitelist = perflog.txt$
followTail = 0
recursive = false
sourcetype = perflogs
index = projectlogs
for these two monitoring stanza's . can i able to control the data inputs monitoring with out restarting the UF. i.e property disabled=true/false can i set to these stanza's with out actually restarting them everytime changing in props.conf ?? or can i control this enabling or disabling from other search head ??
Is this possibile??
You can use the CLI command line to edit the config without restarting to apply.\
./splunk disable monitor "/project/logs1/"
You can POST a reload on the respective REST endpoint on the Universal Forwarder. For example:
https://my-universal-forwarder:8089/services/data/inputs/monitor/_reload
Thanks .. can i give it for a particular montior stanza ??