Getting Data In

splunk universal forwarder not pullng custom logs.

suryaaruna
New Member

Team,

I am having some windows servers which am able to get windows event logs, perfmons but the custom logs am not able to pull the same.

here is my inputs.conf configuration. i have checked the case sensitivity too as we got one situation wherein correction of case sensitivity didfix the issue. But in this case none is working for me.

[monitor:///D:\logfiles\ARBGlobal\SalesCoreApp\SaleCoreApp.log]
sourcetype = salescore
disabled = 0
ignoreOlderThan=7d

Request your help in fixing the issue.

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi òsuryaaruna,
you have to use only two slashes before path, not three, three is for Unix:

[monitor://D:\logfiles\ARBGlobal\SalesCoreApp\SaleCoreApp.log]

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi òsuryaaruna,
you have to use only two slashes before path, not three, three is for Unix:

[monitor://D:\logfiles\ARBGlobal\SalesCoreApp\SaleCoreApp.log]

Ciao.
Giuseppe

View solution in original post

0 Karma

suryaaruna
New Member

oh yes. thanks. it is two slashes. Thanks for your help.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!