Log File Monitoring for specific string, rotating log file names, server requirements

[bishop609]

Hello, fairly new to splunk. I have 3 servers that all have text based log files on them. We need to monitor those log entries for specific strings, and email us when that string appears. What do I need to have installed on those servers to monitor those log files? Forwarder? Or something else. And then how do we get around the fact that the log file names keep changing? Watch the directory, I suppose.

Lastly, what are the the partition requirements for splunk...I would like to put the main splunk server on D:, and I need to know if I should boost the D; drive space.

Thank you Very Much!

[yannK]

Hi, you are correct on every point :

1. configure the indexer first
2. install on 😧 if you prefer. (if needed you can install on C: and change the path to the indexes to be on D:) (each default index has up to 500GB size)

3. configure a port to accept data from forwarders (default is 9997)

4. install the universal forwarder on the servers to monitor

5. specify the address/port of the indexer

6. during the install in the wizard, or after in the inputs.conf config file, define a monitor input on the folders.
   [monitor://C:\path\to\my\fodler]
   If needed, add a white/blacklists to narrow the files to monitor.

7. If you want windows event logs, use the WMI inputs.

For the size requirements, it depends of your retention policy, and of the volume indexed per day, if you want you can run a test for a week and see.