Using monitor on a Universal Forwarder

[nce054]

I'm trying to set up my Universal Forwarder to monitor a local folder. The folder path is H:\MonitorTest , and I have placed multiple text files in there to manipulate and see if the changes are recorded in my Search-Head. However, after putting the following code in $SPLUNK_HOME\etc\system\local\inputs.conf, I still am not seeing any new data on my Search-Head. Am I doing something incorrectly? I know this is a very basic question, as I am new to Splunk. Thanks for any help!

[monitor://C:\..\H:\MonitorTest]
disabled = 0
index = main

[masonmorales]

Looks like you are missing sourcetype. Also, I'm not sure why you have C:\ in there. I think your stanza should be something like:

[monitor://H:\MonitorTest\]
disabled = 0
index = main
sourcetype = test

Then, restart the Splunk forwarder and see if it picks up your test files.

[nce054]

I tried this, and no luck still. I have the index of 'main' enabled on my Search-Head, so I know that's not the issue.

[masonmorales]

I am assuming you have two boxes, one with a UF, the other acting as an Indexer+SH. Is that correct?

If so, what happens if you search:

index=_internal *test*

Does anything show up? Any errors? If not, you may want to check network connectivity between the UF and Indexer/SH. You can do that using the telnet command, or by searching for TcpOutput in splunkd.log on the UF.

If you can post your outputs.conf that might be helpful too.

[nce054]

Yes, I have one UF, two Indexers, and one Search-Head, all dedicated instances. I know they are linked up correctly because I am already receiving Windows Event log entries, such as System, Security, and Application.

[masonmorales]

I think we need a diag from your UF to troubleshoot this further. If you can send me an e-mail (click my username to see it), I'll send you a login for my FTP server and we'll go from there.

[nce054]

I actually can't see it, all I see is your LinkedIn account, among other things.

[masonmorales]

Sorry, refresh it. 🙂