I have universal forwarder installed on a Windows 2008 box. I have a directory c:\logs\firewall setup where I am pointing the Windows firewall logs. I want to have the universal forwarder pick these up and send them to the indexer. I am newb and have read through the doc and its not really clear to me on how to do this. I know I need to edit the inputs.conf but I am not sure of the syntax.
actually: [monitor://c:\\c:\logs\firewall], i.e., only one colon. You don't need the disabled=0 clause, that's default, and most of hte time you don't need the hostname if the local forwarder host is correct.