Getting Data In

Is this the correct stanza and location to monitor specific files on a *nix server with a universal forwarder?

w0lverineNOP
Path Finder

I am trying to have my universal forwarder monitor a specific file or sets of files on a *nix server:
Would this be the correct stanza to place into my outputs.conf file location?: /opt/spplunkforwarder/etc/system/local

stanza:

[monitor:///var/log/xxxxx/*]

Source: http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Configureforwarderswithoutputs.confd

0 Karma
1 Solution

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi w0lverineNOP

You configure the monitoring of files in inputs.conf . Outputs.conf defines where the forwarder should send the data it is capturing in inputs.conf.

Does that make sense?

The correct entry in inputs.conf would be something like this:

[monitor:///var/log/access.log]
disabled = false
sourcetype = access_combined

You can also use wildcards with the * symbol.

Full docs here:
http://docs.splunk.com/Documentation/Splunk/6.3.2/admin/inputsconf

Let me know how you get along.

j

View solution in original post

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi w0lverineNOP

You configure the monitoring of files in inputs.conf . Outputs.conf defines where the forwarder should send the data it is capturing in inputs.conf.

Does that make sense?

The correct entry in inputs.conf would be something like this:

[monitor:///var/log/access.log]
disabled = false
sourcetype = access_combined

You can also use wildcards with the * symbol.

Full docs here:
http://docs.splunk.com/Documentation/Splunk/6.3.2/admin/inputsconf

Let me know how you get along.

j

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Monitoring configurations should be in your inputs conf. ie : /opt/spplunkforwarder/etc/system/local/inputs.conf

See here : http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Editinputs.conf

For wildcard : http://docs.splunk.com/Documentation/Splunk/6.1/Data/Specifyinputpathswithwildcards

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!