- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to set up log file monitoring on a Windows uni...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to set up .log file monitoring so splunk would pull the context of the .log files in to the indexer and nothing i try seems to work.....
Can someone please help? I'm a newbie at this whole splunk thing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi mkaplan1979,
you're using *nix path name convention on a Windows machine. Your input should like this:
[monitor://D:\logfiles\log123.log]
maybe something like this:
[monitor://C:\pos\TKAgent\Location Agents\log\]
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi mkaplan1979,
you're using *nix path name convention on a Windows machine. Your input should like this:
[monitor://D:\logfiles\log123.log]
maybe something like this:
[monitor://C:\pos\TKAgent\Location Agents\log\]
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you MuS it worked!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is inputs.conf on the forwarder
[default]
host = MPK005-Server
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
[monitor://pos/log/]
disabled = false
sourcetype = syslog
index = pos
[monitor://pos/TKAgent/Location Agents/log/]
disabled = false
sourcetype = syslog
index = pos
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
UF is on windows as well. I'll post what I've tried in a minute
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BTW I'm running splunk enterprise on windows and using universal forwarder on the client
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What have you tried so far? Is the UF client Linux or Windows?
If this reply helps you, Karma would be appreciated.
.conf24 | Day 0
Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...
Troubleshooting the OpenTelemetry Collector
