Im testing Splunk locally.. Is there a way to have a folder on my desktop that will constantly sync with splunk?

[alanxu]

I want to create a folder on my desktop where I will hold log files for each day. Is there a way when a file is added to the directory it will automatically sync with my splunk database?

Thanks
Alan

EDIT: Got it to work. Thanks for all your help!

[woodcock]

Yes, edit $SPLUNK_HOME/etc/system/local/inputs.conf and add it like this:

[monitor://C:\users\*\desktop\splunkme\*]
index=main
sourcetype=constant_deskctop_sync

[alanxu]

Got it to work.. Thanks

[alanxu]

Where will I be doing this?

[woodcock]

On your desktop server after you install Splunk there (which I thought you had already done).

[martin_mueller · Accepted solution]

Assuming your Splunk server is running on your local computer, all you need is an inputs.conf entry like this:

[monitor:///path/to/your/folder]
index = your_index
sourcetype = your_sourcetype

Splunk will then constantly index new lines added to files in that folder.

[martin_mueller]

This has an explanation of common keys used: http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Editinputs.conf

[alanxu]

I got it to work! Thanks

[alanxu]

I found the inputs.config file... Right now all I have is the host = xxxxxxxxxxxxxxxxxx

And then I added your lines...
[monitor:\C:\Users......]
index=??
sourcetype=???

My sourcetype changes and what is index?

[alanxu]

Where will I be doing this?

[ChrisG]

If you are new to the configuration file system, definitely read the documentation topics starting with About configuration files in the Admin Manual. You need to understand the directory structure and precedence.

[alanxu]

If Im doing it with Splunk web using localhost where would I find the config files?

[martin_mueller]

If you're on Windows, typically C:\Program Files\Splunk\etc.