windows application log files.

[alanhowlett]

I'm trying to configure splunk to ingest two application logfiles, not the event logs the actual application logfile (text).

Its my first time ingesting windows forwarder logs (I'm a linux man really), but I did read that it can be done in the inputs.conf so I tried the below:

[monitor://D:\lfbank\wincsl\logs\wincsl-service.log]
disabled = 0
index = wincsl
souurcetype = lfab_wincsl1

[monitor://D:\inetpub\logs\logfiles\W3SVC*]
disabled = 0
index = wincsl
souurcetype = lfab_wincsl2

I do have an outputs.conf configured, but am still seeing no data.

[vsai0718]

You need to add WindEventLog:Application stanza before monitor.
For Example:

[WinEventLog:Application]
disabled = 0
start_from = oldest
current_only = 0

[alanhowlett]

I don't have access to the forwarders. I'm just using the deployment server to send the configs out.

I'm going to have to check things tomorrow with the engineer on site.

As long as my syntax is ok.

[briancronrath]

What does your splunk forwarder logs say, are there any lines including the names of these logs?

[alanhowlett]

Corrected the typo drrrrrr. Still not working.

If I look in the GUI I don't see the index, but I have another built and that does show up either. But works.

[kmorris_splunk]

Set your search to All Time, just in case there are timestamping issues. You can also click on the Data Summary which has host, source and sourcetype tabs where you can look at all of the values for each to see if you can see the values you are expecting for any of those metadata fields.

Also, make sure you have no firewalls blocking the traffic. I'm making the assumption that you are already listening on port 9997 on your indexers as well.

[alanhowlett]

So is the config above ok ( without the typo).

we are setup for port 9998 using ssl certs signed by the client. And we do have other forwarders that are working ok.

I can see the new indexer now found a config error.

[kmorris_splunk]

Does the wincsl index exist? Also, not sure if this is a typo in your question, or if this is the way your inputs.conf looks, but sourcetype is spelled incorrectly It has two u's.