Getting Data In

Universal Forwarder folder path monitor

Contributor

What stanza do i set in the Universal Forwarder to send data to the indexers from a folder path?
I want to send output from "/var/log/file.log" to the indexers in a new index called "IndexA".

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this:

[monitor:///var/log/file.log]
index = IndexA
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Contributor

they both work. Thank you all!

0 Karma

SplunkTrust
SplunkTrust

Try this:

[monitor:///var/log/file.log]
index = IndexA
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Define your host

host = Your Hostname

[monitor:///var/log/file.log]
disabled = false
sourcetype = Your sourcetype
index = indexA

Contributor

where would i set this in the Universal Forwarder?

0 Karma

SplunkTrust
SplunkTrust

It didn't save correctly, I edited my post and added the index part back into the Stanza.

0 Karma

SplunkTrust
SplunkTrust

If your on a linux box go to
/splunk/etc/system/local vi inputs.conf

If your on Windows then splunk\etc\system\local then open the inputs.conf and add the stanza

Don't forget to restart your Splunk service after making these changes

0 Karma