- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Using monitor on a Universal Forwarder
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using monitor on a Universal Forwarder
I'm trying to set up my Universal Forwarder to monitor a local folder. The folder path is H:\MonitorTest , and I have placed multiple text files in there to manipulate and see if the changes are recorded in my Search-Head. However, after putting the following code in $SPLUNK_HOME\etc\system\local\inputs.conf, I still am not seeing any new data on my Search-Head. Am I doing something incorrectly? I know this is a very basic question, as I am new to Splunk. Thanks for any help!
[monitor://C:\..\H:\MonitorTest]
disabled = 0
index = main
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks like you are missing sourcetype. Also, I'm not sure why you have C:\ in there. I think your stanza should be something like:
[monitor://H:\MonitorTest\]
disabled = 0
index = main
sourcetype = test
Then, restart the Splunk forwarder and see if it picks up your test files.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried this, and no luck still. I have the index of 'main' enabled on my Search-Head, so I know that's not the issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am assuming you have two boxes, one with a UF, the other acting as an Indexer+SH. Is that correct?
If so, what happens if you search:
index=_internal *test*
Does anything show up? Any errors? If not, you may want to check network connectivity between the UF and Indexer/SH. You can do that using the telnet command, or by searching for TcpOutput in splunkd.log on the UF.
If you can post your outputs.conf that might be helpful too.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, I have one UF, two Indexers, and one Search-Head, all dedicated instances. I know they are linked up correctly because I am already receiving Windows Event log entries, such as System, Security, and Application.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think we need a diag from your UF to troubleshoot this further. If you can send me an e-mail (click my username to see it), I'll send you a login for my FTP server and we'll go from there.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I actually can't see it, all I see is your LinkedIn account, among other things.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, refresh it. 🙂
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
