Getting Data In

Why is collecting remote data not working?

judges88
Explorer

(This may be Vague because what its on so sorry ) I have lets say 2 servers. The "Splunk" server, and then the "Target" server. There are certain logs on the Target server that im trying to get to report to splunk. And for some reason they just arent going. Tried editing the inputs a few times. I get 2 of the 3 files reporting to splunk but for some reason it wont capture the other one. 

Ive tried a few variations on the Inputs.conf file to capture these logs. Not sure if i need to specify the log type in the conf file or if im just being dumb. This is one of those things ive been working on for a while so my mind is mush. So here i am. 


There is a "Banner.LogTypeHere" "Host.LogTypeHere" and a "UserDAC.LogTypeHere" I get the Banner and Host to show up but for some reason the UserDAC doesnt populate. 

Just some dumb variations ive tried in inputs. 

[monitor: %ProgramData%\XXX\XXX\Logs]

[monitor: %ProgramData%\XXX\XXX\Logs\*.LogTypeHere]

[monitor: c:\ProgramData\XXX\XXX\Log]

Labels (4)
0 Karma
1 Solution

judges88
Explorer

Not sure what the final resolution was, came in today after a long weekend and everything was reporting. 

View solution in original post

0 Karma

judges88
Explorer

Not sure what the final resolution was, came in today after a long weekend and everything was reporting. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does Splunk have access to all of the files it is trying to monitor?  Can you install a UF on the Target server so the files can be monitored locally?

---
If this reply helps you, Karma would be appreciated.

judges88
Explorer

Sorry for the long delay with the weekend i wanted to take a break from work ahah. But Yes the UF is installed on all of our servers we have. And they all report back to our host Splunk Server. 

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...