Monitor a path on the search head

[RanjithaN99]

Hi Community, 

Please help me out, I am trying to monitor a path on the splunk search head in a Splunk enterprise environment.

What would be the best practice to implement this?

Would it be advisable to install a UF on the search head server ?

If not, what are the other ways by which we can monitor a path on the splunk search head server.

Thanks,

[gcusello · Accepted solution]

Hi @RanjithaN99,

you don't need to install an UF on the Search Head.

Your SH should already send its own logs to the indexers.

In this case, you have only to enable the input from your GUI or CLI.

Only one attention point: using GUI you probably don't have the indexer in the available indexes list.

You can solve this in two ways:

• you could create an index with the same name on the Search Head, even if the logs will not go in this index but in the one (with the same name)  on the indexer,
• you could create the input by CLI.

Ciao.

Giuseppe

[RanjithaN99]

Thank You