Getting Data In

How to configure directory and file monitoring on a universal forwarder?

ageorgiou
Explorer

Hi,

I've got a universal forwarder and I'm trying to monitor C:\Windows\System32\winevt\Logs. I've tried 2 solutions: CLI and Inputs.conf.

CLI: Splunk add monitor C:\Windows\System32\winevt\Logs
inputs.conf:

[monitor://C:\Windows\System32\winevt\Logs]
disabled = 0

Both solutions are not working and I've tried a combination of the two. Am I missing a step? Are there anyways to troubleshoot this so I can get a clear picture of whats happening ( in this case, not happening)?

0 Karma
1 Solution

ageorgiou
Explorer

The logs that I was trying to monitor is a Windows Event Log which monitor stanza can't monitor dynamically. To monitor Windows event log you have to use the stanza [WinEventLog]. See this documentation for more details:
http://docs.splunk.com/Documentation/Splunk/6.2.7/Data/MonitorWindowsdata

View solution in original post

0 Karma

ageorgiou
Explorer

The logs that I was trying to monitor is a Windows Event Log which monitor stanza can't monitor dynamically. To monitor Windows event log you have to use the stanza [WinEventLog]. See this documentation for more details:
http://docs.splunk.com/Documentation/Splunk/6.2.7/Data/MonitorWindowsdata

0 Karma

ageorgiou
Explorer

I tried putting the path in $SPLUNK_HOME/etc/app/ and it worked but it doesn't monitor the logs in real-time and it seems to only get the logs once.

0 Karma

ageorgiou
Explorer

The only time the logs are updated is when I restart the forwarder.

0 Karma

NOUMSSI
Builder

Hi,
Try this

Splunk add monitor C:\Windows\System32\winevt\Logs -index indexName
0 Karma

ageorgiou
Explorer

This one doesn't seem to be working as well. I've also made sure that the index is created in the Indexer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...