Universal Forwarder folder path monitor

[sbattista09]

What stanza do i set in the Universal Forwarder to send data to the indexers from a folder path?
I want to send output from "/var/log/file.log" to the indexers in a new index called "IndexA".

[sbattista09]

they both work. Thank you all!

[richgalloway · Accepted solution]

Try this:

[monitor:///var/log/file.log]
index = IndexA

[skoelpin]

Define your host

host = Your Hostname

[monitor:///var/log/file.log]
disabled = false
sourcetype = Your sourcetype
index = indexA

[sbattista09]

where would i set this in the Universal Forwarder?

[skoelpin]

It didn't save correctly, I edited my post and added the index part back into the Stanza.

[skoelpin]

If your on a linux box go to
/splunk/etc/system/local vi inputs.conf

If your on Windows then splunk\etc\system\local then open the inputs.conf and add the stanza

Don't forget to restart your Splunk service after making these changes