How to configure universal forwarder on Linux to send a log file to Splunk heavy forwarder?

[vnguyen46]

Hi,
I installed and configured UF on a Linux server to send syslog to Splunk HF. I am now trying to send an application log also on the same server, say it's in /opt/application/applog.log, to the HF. What I need to modify on the UF .conf file(s) ?

Thanks.

[manjunathmeti · Accepted solution]

If universal forwarder is already connecting to heavy forwarder then you can just add a MONITOR input to forward applog.log in inputs.conf on UF.

[monitor:///opt/application/applog.log]
disabled = false
index = <index_name>
sourcetype = <sourcetype_name>
crcSalt = 

[vnguyen46]

Thank you.

[manjunathmeti]

you are welcome 🙂