I have configured the logs in the inputs.conf and added the servers in the serverclass.conf. Preliminary testing done to check if the client servers can connect to the splunk deployment server and communication port - all good.
output.conf looks like the following:
defaultGroup = zone1
disabled = false
[tcpout:zone1]
server = deploymentserver:9996,heavyforwarederserver:9996
[tcpout-server://deploymentserver:9996]
[tcpout-server://heavyforwarder:9996]
inputs.log looks like the following:
[monitor://D:\Program Files (x86)...\vCAC...\Logs*]
index = index_name
sourcetype = sourcetype_name
Additional info: servers have an existing WinEventlog and Perfmon setup in splunk.
For some reason, the changes are not being picked up the splunk GUI. Should there be any other config that needs to be done?
For one if the following syntax is what you actually have in your inputs.conf it is incorrect.
You have: [monitor://D:Program Files (x86)...vCAC...Logs*]
You should have: [monitor://D:\Program Files (x86)....vCAC....Logs.....*]
you were missing the "\"
after the "D:"
Sorry, might have been omitted during the paste. But the actual syntaxt has "\"
after the "D:"
. So it is [monitor://D:\Program Files (x86)\...\vCAC\...\Logs\*]
I've never tried to monitor a path with white spaces in the name. For testing purposes point it to a path with no spaces and see if you have any issues.
So the syntax should be like this [monitor://D:\Program*\...\vCAC\...\Logs\*]
? Will an asterisk (*) followed by ellipses (...) work in inputs.conf? Have you tried it before to monitor a path?
just tried doing without the spaces by editing the monitor to use Program*
but unfortunately it still didn't work.
Any idea how Program Files or Program Files (x86) can be monitored in splunk?
The inputs.conf file you are talking about above, is that the $splunk\etc\system\local\inputs.conf
or $splunk\etc\apps\deployment....\inputs.conf?
the one in $splunk\etc\deployment....\inputs.conf