Inputs.conf not being read

[leon24]

OK this sounds pretty embarrassing. I have set up quite a fair bit of Splunkforwarders previously but now I some of my newly configured forwarders are unable to forward the logs to the indexers (or the indexers are unable to index the logs forwarded).

This is what is in my inputs.conf in $SPLUNK_HOME$/etc/apps/iis/local/ in the server where my forwarder is installed.

[install] state = enabled

[monitor://D:\Logs\]

disabled = 0
followTail = 0
index = project_index
blacklist = .(1|2|3|4|5|6|7|8|9|0)$
sourcetype = project_logs

The issue here is that this particular forwarder is able to send perfmon logs to the indexer, but is unable to read this particular inputs.conf file.

My search at the search head is simply <code>index = project_index | stats count by sourcetype</code>, but I'm not seeing the project_logs sourcetype appearing at all, only apart from the perfmon sourcetype.

Am I missing anything here?

Regards

[woodcock]

Could be permissions if you are not running splunk as root/admin user; have you checked ownership and permissions? Or perhaps you have the path wrong; try this (missing backslash):

[monitor://D:\Logs]

[woodcock]

Did you get this working?