Getting Data In
Highlighted

How to monitor .lst files

Communicator

Hi Splunkers,

Good day. Would like to ask regarding monitoring .lst, for your insight, .lst files are files oracle logs pulled from the server. When I'm trying the traditional way of monitoring logs (inputs.conf configuration), our Splunk is not reading the files unless otherwise renames as .log. Please see details:

**inputs.conf**
[monitor:///home/oracle/LAR/*.lst]
disabled = 0
index = oracledb

Sample data
alt text

0 Karma
Highlighted

Re: How to monitor .lst files

SplunkTrust
SplunkTrust

hello there,

can you try and use the GUI to upload the file and see how it looks like?
navigate to settings - > add data -> upload -> go from there.
you might need to copy the .lst file to your desktop

hope it helps

0 Karma
Highlighted

Re: How to monitor .lst files

Communicator

Tried it also, it is indeed working, however, our client wants to use the Splunk Universal Forwarder installed on that server instead of uploading it to our Splunk manually which is the right way. Thanks for the answer by the way 🙂

0 Karma
Highlighted

Re: How to monitor .lst files

SplunkTrust
SplunkTrust

you are welcome,
it is very odd that the forwarder does not pick it up. when you bring the data using a Universal Forwarder and the monitor stanza, do you see text or gibrish?
btw, you can install a full splunk instance and have it monitor and send data - Heavy Forwarder.
let me know so we can solve it

0 Karma
Highlighted

Re: How to monitor .lst files

Communicator

Resolved the issue by adding _whitelist = \.lst$ in the inputs.conf

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.