Getting Data In

Collect logfiles

DriesVloeberghe
New Member

I want to collect logfiles in Splunk through the Universal Forwarder.
I've set up a forward for the logs of the eventviewer and that is working!
But now I've set up a forward for logs on a specific location C:\Test, but that's not working. (there are log-files in it of course)
What can be the reason? How can I check what's being wrong?

Tags (1)
0 Karma
1 Solution

horsefez
SplunkTrust
SplunkTrust

Hey DriesVloeberghen,

as someone who isn't into your config it would be helpful for me if you could post your inputs.conf of the UF.


I try to suggest some possible solutions to your problem.

  • Check your inputs.conf [monitor-stanza] The stanza is a perfect place to spot faulty configuration Monitoring files under C:\Test (if Test ist actually the name of your file) should result in the following stanza:

[monitor://C:\Test]

  • If "Test" is actually a directory in which the files are placed it should look like the following:

[monitor://C:\Test\*]

  • If "Test" is actually a file and might be an .txt you should write that into your stanza:

[monitor://C:\Test.txt]
or you could do something like this
[monitor://C:\Test*]

  • Has the user who runs the UF on the System (if not the root user) sufficient permissions to read the files under C:\Test ?

Best regards,
pyro_wood

View solution in original post

0 Karma

DriesVloeberghe
New Member

Ok thanks, it seems that the logfiles of yesterday are in. But then I've got 2 other questions.
- after how many time the files are uploaded?
- it seems that I have to search on: source="c:\test\test1.log" - How can I search on a folder?

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hey DriesVloeberghen,

as someone who isn't into your config it would be helpful for me if you could post your inputs.conf of the UF.


I try to suggest some possible solutions to your problem.

  • Check your inputs.conf [monitor-stanza] The stanza is a perfect place to spot faulty configuration Monitoring files under C:\Test (if Test ist actually the name of your file) should result in the following stanza:

[monitor://C:\Test]

  • If "Test" is actually a directory in which the files are placed it should look like the following:

[monitor://C:\Test\*]

  • If "Test" is actually a file and might be an .txt you should write that into your stanza:

[monitor://C:\Test.txt]
or you could do something like this
[monitor://C:\Test*]

  • Has the user who runs the UF on the System (if not the root user) sufficient permissions to read the files under C:\Test ?

Best regards,
pyro_wood

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

Troubleshooting Monitor inputs can be troublesome it can usually be solved by inspecting the Splunkd.log, familiarity with btool and my favorite hit the rest endpoint on the forwarder to see the current status of the tailingprocessor.

Although this Wiki is old it has great information for troubleshooting monitor inputs:

http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart the forwarder?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...