How to monitor .lst files

[dantimola]

Hi Splunkers,

Good day. Would like to ask regarding monitoring .lst, for your insight, .lst files are files oracle logs pulled from the server. When I'm trying the traditional way of monitoring logs (inputs.conf configuration), our Splunk is not reading the files unless otherwise renames as .log. Please see details:

**inputs.conf**
[monitor:///home/oracle/LAR/*.lst]
disabled = 0
index = oracledb

Sample data

[dantimola · Accepted solution]

Resolved the issue by adding _whitelist = \.lst$ in the inputs.conf

[adonio]

hello there,

can you try and use the GUI to upload the file and see how it looks like?
navigate to settings - > add data -> upload -> go from there.
you might need to copy the .lst file to your desktop

hope it helps

[dantimola]

Tried it also, it is indeed working, however, our client wants to use the Splunk Universal Forwarder installed on that server instead of uploading it to our Splunk manually which is the right way. Thanks for the answer by the way 🙂

[adonio]

you are welcome,
it is very odd that the forwarder does not pick it up. when you bring the data using a Universal Forwarder and the monitor stanza, do you see text or gibrish?
btw, you can install a full splunk instance and have it monitor and send data - Heavy Forwarder.
let me know so we can solve it