Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Why am I not seeing the logs in splunk GUI aft...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why am I not seeing the logs in splunk GUI after configuring it in deployment servers?
I have configured the logs in the inputs.conf and added the servers in the serverclass.conf. Preliminary testing done to check if the client servers can connect to the splunk deployment server and communication port - all good.
output.conf looks like the following:
defaultGroup = zone1
disabled = false
[tcpout:zone1]
server = deploymentserver:9996,heavyforwarederserver:9996
[tcpout-server://deploymentserver:9996]
[tcpout-server://heavyforwarder:9996]
inputs.log looks like the following:
[monitor://D:\Program Files (x86)...\vCAC...\Logs*]
index = index_name
sourcetype = sourcetype_name
Additional info: servers have an existing WinEventlog and Perfmon setup in splunk.
For some reason, the changes are not being picked up the splunk GUI. Should there be any other config that needs to be done?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For one if the following syntax is what you actually have in your inputs.conf it is incorrect.
You have: [monitor://D:Program Files (x86)...vCAC...Logs*]
You should have: [monitor://D:\Program Files (x86)....vCAC....Logs.....*]
you were missing the "\" after the "D:"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, might have been omitted during the paste. But the actual syntaxt has "\" after the "D:". So it is [monitor://D:\Program Files (x86)\...\vCAC\...\Logs\*]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've never tried to monitor a path with white spaces in the name. For testing purposes point it to a path with no spaces and see if you have any issues.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So the syntax should be like this [monitor://D:\Program*\...\vCAC\...\Logs\*] ? Will an asterisk (*) followed by ellipses (...) work in inputs.conf? Have you tried it before to monitor a path?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
just tried doing without the spaces by editing the monitor to use Program* but unfortunately it still didn't work.
Any idea how Program Files or Program Files (x86) can be monitored in splunk?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The inputs.conf file you are talking about above, is that the $splunk\etc\system\local\inputs.conf or $splunk\etc\apps\deployment....\inputs.conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the one in $splunk\etc\deployment....\inputs.conf
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
