- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to set up log file monitoring on a Windows uni...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to set up .log file monitoring so splunk would pull the context of the .log files in to the indexer and nothing i try seems to work.....
Can someone please help? I'm a newbie at this whole splunk thing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi mkaplan1979,
you're using *nix path name convention on a Windows machine. Your input should like this:
[monitor://D:\logfiles\log123.log]
maybe something like this:
[monitor://C:\pos\TKAgent\Location Agents\log\]
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi mkaplan1979,
you're using *nix path name convention on a Windows machine. Your input should like this:
[monitor://D:\logfiles\log123.log]
maybe something like this:
[monitor://C:\pos\TKAgent\Location Agents\log\]
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you MuS it worked!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is inputs.conf on the forwarder
[default]
host = MPK005-Server
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
[monitor://pos/log/]
disabled = false
sourcetype = syslog
index = pos
[monitor://pos/TKAgent/Location Agents/log/]
disabled = false
sourcetype = syslog
index = pos
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
UF is on windows as well. I'll post what I've tried in a minute
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BTW I'm running splunk enterprise on windows and using universal forwarder on the client
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What have you tried so far? Is the UF client Linux or Windows?
If this reply helps you, Karma would be appreciated.
Monitoring MariaDB and MySQL
Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...
Splunk Federated Analytics for Amazon Security Lake
