File monitoring windows to linux

[mjlsnombrado]

Hi, I have a Windows machine as a Universal forwarder which forwards data to Splunk instance on a Linux box. I want the csv file on the windows forwarder to be monitored on Splunk. It is showing on the forwarded inputs but its not getting indexed on the Splunk instance.

inputs.conf
[monitor://C:\Users\mjsn\Desktop\linuxToWindowsTest\mgmt_test.csv]
disabled = false
index = vm_test_app_idx
sourcetype= st_vm_test_app

outputs.conf
[tcpout]
defaultGroup = monitor_test

[tcpout:monitor_test]
server = 10.5.2.77:9997

[richgalloway]

Check your default index. Also, try searching "the future" in case timestamps are off. That is, set latest=+24h in your query.

[ansif]

Check if index is defined in the Indexer? if other monitor are working from the UF then ports are fine.

check the internal log with mgmt_test.csv ,that will tell you some clue why it is dropping at indexer.

[bojanisch]

I assume these configs are on the UF. Have you defined the index on your Linux box? Also have you enabled the port listening on the indexer? And is the IP reachable from the UF?

[mjlsnombrado]

Yes, I enabled the port on the indexer, also the IP is reachable from the UF

[bojanisch]

Any errors visible in your _internal logs on your indexer? Maybe permission issues? Note that Splunks config are case sensitive, maybe a mistyping in your path?