Getting Data In

add log file to splunk universal forwarder

jszyba
New Member

I'm trying to monitor a log file to a splunk universal forwarder. For example the splunkd.log file. I've tried getting into the inputs.conf file on the machine with the universal forwarder intstalled and adding [monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]. I can't see the log file on the main reciever. What am I missing here? Please help....

Tags (3)
0 Karma

rkirkw
Path Finder

The splunkd.log is most likely already being sent by the forwarder but you may not be searching the internal indexes by default.

Try this search:
index=_internal source="/opt/splunkforwarder/var/log/splunk/splunkd.log" host=hostname

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That file should be monitored automatically, search the _internal index for it.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...