Getting Data In

Forwarding profiles - how to


Is there any way to set up profiles for commonly forwarded logs? I see:

details logs. Is there any way I can set up a profile from the indexer to grab all the SystemErr.log, SystemOut.logs from app servers?

BTW, I'm running Splunk 5.0.2 on Red Hat 6.3. I have 2 indexers that are replicating, two search heads, and one master. Perhaps 80 devices are forwarding to the indexers.

Tags (1)
0 Karma


Thanks for the answer. What I wound up doing was adding lines to my expect script like so:

    expect "]#" { send "find /opt/IBM -name 'SystemErr.log' > $tempfile\r" }
    expect "]#" { send "find /opt/IBM -name 'SystemOut.log' >> $tempfile\r" }
    expect "]#" { send "find /opt/IBM -name 'trace.log' >> $tempfile\r" }
    expect "]#" { send "sed -i 's/^/\[monitor\:\\/\\//' $tempfile\r" }
    expect "]#" { send "sed -i 's/$/\]/' $tempfile\r" }
    expect "]#" { send "cat $tempfile >> $inputfile\r" }
    expect "]#" { send "/opt/splunkforwarder/bin/splunk restart\r" }
    expect "]#" { send "ps -ef | grep splunk\r" }

where $inputfile is /opt/splunkforwarder/etc/system/local/inputs.conf

This produces output like this in the inputs.conf file:


0 Karma


You might want to set the monitor to /opt/*.log or a similar expression matching all your log files, and then whitelisting (or blacklisting) your way towards the correct set of files.

0 Karma


Follow up question. Let's say I want to monitor three files, /opt/a.log, /opt/b.log, /opt/c.log

What would the [monitor://xxxx] statement in inputs.conf look like? Could I do this:


or does it have to be



0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: CFP Site: CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...