Getting Data In

How to edit my monitor stanza in inputs.conf on the deployment server to collect logs from our forwarders?

New Member

Hi All,

I have a Splunk environment with deployment server and forwarders of nearly 200. In one of the deployment apps folders, I have updated the inputs.conf file with the below stanza


After deploying the serverclass, I am not able to receive the logs. I have checked the forwarder, but everything is fine and is sending other logs. So I doubt at the inputs stanza only. So can anyone help in identifying the mistake I have done in the regex?

Thanks in advance

0 Karma

Path Finder

First off I would encourage you to run your regex through regex101

Next can you please provide a sample of the file names. You can also 'save' these in the regex101 as well as here.

Did you verify file permissions and did you look in /var/log/splunk on a forwarder where the data is?

Are you using a regex in the monitor as well? "(NFT|NFOT)"? If you read when and when Regex works ( ).
You may need to add a * after your regex.


Lastly you did not escape your last . (via .) which should not matter here, but it's good practice.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!