I have installed a universal forwarder on Free_PBX to forward call queue logs to Splunk enterprise, everything works probably. I monitored the folder of logs which is located on /var/log/asterisk
I can monitor all log files while they are updating events daily but PBX generates a new log file every day these newly generated logs I can't find on Splunk enterprise. unless I restart universal forwarder then new log files appears on the data summary !
note: FREE_PBX is a Linux CentOS Based VOIP Server
Thank you @Hussein90,
Unfortunately, I cannot think of any reason. It may be a permission problem or the files could be very similar, but in those cases, you cannot index them by restarting UF.
Thanks for your answer I think the issue is that UF cannot send newly generated logs, of course, we chose a folder to monitor but UF wont upload new log files only one-shot upload nd keep update the events
The inputs.conf file location depends on how you created the monitor. If you created using GUI on deployment server it should have created an app for UF. You can search under /opt/splunkforwarder/etc/apps folder.
Or you can use btool on UF using below command
/opt/splunkforwarder/bin/splunk btool inputs list --debug | grep local
You can share output of above command
I've found following inputs.conf when I run the command you gave me
disabled = false