Windows Splunk forwarder inputs other than WinEventLogs?

[dctopper]

Hello,

I'd like to forward the SetupAPI.dev.log to Splunk, but I'm not sure what stanza to put into the inputs.conf file. Any ideas?

Thanks

[zoh · Accepted solution]

Add following in %SPLUNK_HOME%\etc\system\local\inputs.conf

[monitor://c:\Program Files(x86)\path_to\SetupAPI.dev.log]
disabled = false
followTail = 0

more info can be seen at http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Editinputs.conf

[dctopper]

Awesome. Thank you.