Getting Data In

How to configure directory and file monitoring on a universal forwarder?

ageorgiou
Explorer

Hi,

I've got a universal forwarder and I'm trying to monitor C:\Windows\System32\winevt\Logs. I've tried 2 solutions: CLI and Inputs.conf.

CLI: Splunk add monitor C:\Windows\System32\winevt\Logs
inputs.conf:

[monitor://C:\Windows\System32\winevt\Logs]
disabled = 0

Both solutions are not working and I've tried a combination of the two. Am I missing a step? Are there anyways to troubleshoot this so I can get a clear picture of whats happening ( in this case, not happening)?

0 Karma
1 Solution

ageorgiou
Explorer

The logs that I was trying to monitor is a Windows Event Log which monitor stanza can't monitor dynamically. To monitor Windows event log you have to use the stanza [WinEventLog]. See this documentation for more details:
http://docs.splunk.com/Documentation/Splunk/6.2.7/Data/MonitorWindowsdata

View solution in original post

0 Karma

ageorgiou
Explorer

The logs that I was trying to monitor is a Windows Event Log which monitor stanza can't monitor dynamically. To monitor Windows event log you have to use the stanza [WinEventLog]. See this documentation for more details:
http://docs.splunk.com/Documentation/Splunk/6.2.7/Data/MonitorWindowsdata

0 Karma

ageorgiou
Explorer

I tried putting the path in $SPLUNK_HOME/etc/app/ and it worked but it doesn't monitor the logs in real-time and it seems to only get the logs once.

0 Karma

ageorgiou
Explorer

The only time the logs are updated is when I restart the forwarder.

0 Karma

NOUMSSI
Builder

Hi,
Try this

Splunk add monitor C:\Windows\System32\winevt\Logs -index indexName
0 Karma

ageorgiou
Explorer

This one doesn't seem to be working as well. I've also made sure that the index is created in the Indexer.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...