splunk universal forwarder not pullng custom logs.

[suryaaruna]

Team,

I am having some windows servers which am able to get windows event logs, perfmons but the custom logs am not able to pull the same.

here is my inputs.conf configuration. i have checked the case sensitivity too as we got one situation wherein correction of case sensitivity didfix the issue. But in this case none is working for me.

[monitor:///D:\logfiles\ARBGlobal\SalesCoreApp\SaleCoreApp.log]
sourcetype = salescore
disabled = 0
ignoreOlderThan=7d

Request your help in fixing the issue.

[gcusello · Accepted solution]

Hi òsuryaaruna,
you have to use only two slashes before path, not three, three is for Unix:

[monitor://D:\logfiles\ARBGlobal\SalesCoreApp\SaleCoreApp.log]

Ciao.
Giuseppe

[suryaaruna]

oh yes. thanks. it is two slashes. Thanks for your help.