Getting Data In

monitoring text based log file on windows

Path Finder


I have following input.conf in an app on my deployment server


The app deploys to the target server fine, and i also have a forwarding app which also deploys fine (I am also monitoring windows event logs, and these appear in the index no problem, so I know both this and the forwarding app work correctly)

However, my stdout.log doesn't seem to be making it into the product_logs index (the index does exist)

I have seen mention of accessing


on the target server, but I get prompted with a login box with no idea what credentials to enter in. likewise if i run the equivalent request from the command line, i get prompted to enter a username and password. after it fails i get a 401 unauthorized error.

I have tried various combinations ...

[Monitor://c:\really long path\in here\logs\stdout.log]

To no avail.

stdout.log does exist and has content, there are no special permissions on the file and the Splunk agent is running as local system

%PRODUCT_HOME% is defined on the target server as a system environment variable, and is in use by other programs, so I know the path is valid.

The splunkd.log doesn't appear to have anything useful to tell me other than the app deployed ok.

I am sure this must be something incredibly simple that I am missing, but I can't see it for the conf.


0 Karma


Some ideas:

  • Search for something that you know is in the data over all time. Perhaps there is a timestamp problem, and the data is really in there, but not at the time you expect.
  • Search index=* for that data. It shouldn't have happened, but what the heck.
  • Is the data recent? If it is older, or has widely varying timestamps, you may need to set some rules in props.conf. Put them in props.conf on the indexer if you are using the Universal Forwarder. Look at the settings for MAX_DAYS_AGO, MAX_DAYS_HENCE, MAX_DIFF_SECS_AGO and MAX_DIFF_SECS_HENCE in props.conf
0 Karma


If you didn't change the default credentials to anything else, the ones you should use are "admin" as username and "changeme" as password.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...