How do you monitor a directory in a client server

[lew]

I'm new to splunk. I am trying to monitor a directory that exists on a different server other than the main splunk server. I have accessed the gui and have gone to settings>data inputs>files & directories>new, but I only get a directory listing for the main splunk server, not the clients. The directory in question also has rotating log files if that matters. thanks

[dineshraj9 · Accepted solution]

If you want to monitor /home/user1/logs/ -

/home/user1/logs/log_type1.log
/home/user1/logs/log_type2.log

You can try putting this in inputs.conf -

[monitor:///home/user1/logs/]
sourcetype = user1_log
index = user
followSymlink=false
blacklist = (.(tar|gz|bz2|tar.gz|tgz|tbz|tbz2|zip|z)$)
whitelist=log_type.+.log$

[lew]

thank you. This answers my question.

[lew]

I have that installed already in the client server

[MuS]

Hi lew,

to do this, it is recommended to install an universal forwarder on the remote server, read the docs about it here http://docs.splunk.com/Documentation/Splunk/6.2.3/Forwarding/Introducingtheuniversalforwarder

If you are not able to install it on the remote server, think of any other option to access the file like network share, FTP upload to the Splunk server. But remember, when ever possible use the universal forwarder to get remote logs.

Hope this helps ...

cheers, MuS

[lew]

lol, ok. Thanks anyway

[lew]

Thank you for the reply. Can you be more specific? The only file I found that matches the contents of that webpage is /splunk/etc/system/README/inputs.conf.spec. So far I have gathered that the scheme is going to look like this.

[monitor: ///path.../logs]

But what I don't understand is how is the indexer server going to know what client server this is going to be for (like hostname yyy.com, for example). Thank you.

[MuS]

Okay, you should start here http://docs.splunk.com/Documentation/Splunk/6.2.3/Installation/ReadytostartusingSplunk - really, it helps a lot.

[lew]

I have universal fowarder installed in the client server already

[MuS]

take a look at the inputs.conf docs http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/inputsconf you must specify your input on the remote server and save the file at $SPLUNK_HOME\etc\system\local\ and for safety restart the universal forwarder once