Getting Data In

How to set up log file monitoring on a Windows universal forwarder?

New Member

I'm trying to set up .log file monitoring so splunk would pull the context of the .log files in to the indexer and nothing i try seems to work.....
Can someone please help? I'm a newbie at this whole splunk thing

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi mkaplan1979,

you're using *nix path name convention on a Windows machine. Your input should like this:

[monitor://D:\logfiles\log123.log]

maybe something like this:

[monitor://C:\pos\TKAgent\Location Agents\log\]

Hope this helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi mkaplan1979,

you're using *nix path name convention on a Windows machine. Your input should like this:

[monitor://D:\logfiles\log123.log]

maybe something like this:

[monitor://C:\pos\TKAgent\Location Agents\log\]

Hope this helps ...

cheers, MuS

View solution in original post

New Member

thank you MuS it worked!

0 Karma

New Member

this is inputs.conf on the forwarder

[default]
host = MPK005-Server

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[monitor://pos/log/]
disabled = false
sourcetype = syslog
index = pos

[monitor://pos/TKAgent/Location Agents/log/]
disabled = false
sourcetype = syslog
index = pos

0 Karma

New Member

UF is on windows as well. I'll post what I've tried in a minute

0 Karma

New Member

BTW I'm running splunk enterprise on windows and using universal forwarder on the client

0 Karma

SplunkTrust
SplunkTrust

What have you tried so far? Is the UF client Linux or Windows?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!