Getting Data In

Log File Monitoring for specific string, rotating log file names, server requirements

bishop609
New Member

Hello, fairly new to splunk. I have 3 servers that all have text based log files on them. We need to monitor those log entries for specific strings, and email us when that string appears. What do I need to have installed on those servers to monitor those log files? Forwarder? Or something else. And then how do we get around the fact that the log file names keep changing? Watch the directory, I suppose.

Lastly, what are the the partition requirements for splunk...I would like to put the main splunk server on D:, and I need to know if I should boost the D; drive space.

Thank you Very Much!

Tags (3)
0 Karma

yannK
Splunk Employee
Splunk Employee

Hi, you are correct on every point :

  1. configure the indexer first
  2. install on 😧 if you prefer. (if needed you can install on C: and change the path to the indexes to be on D:) (each default index has up to 500GB size)
  3. configure a port to accept data from forwarders (default is 9997)

  4. install the universal forwarder on the servers to monitor

  5. specify the address/port of the indexer

  6. during the install in the wizard, or after in the inputs.conf config file, define a monitor input on the folders.
    [monitor://C:\path\to\my\fodler]
    If needed, add a white/blacklists to narrow the files to monitor.

  7. If you want windows event logs, use the WMI inputs.

For the size requirements, it depends of your retention policy, and of the volume indexed per day, if you want you can run a test for a week and see.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...