splunk search head

[Siddharthnegi]

Can i monitor a file in search head?

[gcusello]

Hi @Siddharthnegi,

yes, it's unusual (usual logs are read by Universal or Heavy Forwarders), but it's possible.

Remember that anyway, it's a best practice to forward all SH logs to the Indexers, so for this reason it's possible.

Ciao.

Giuseppe

[Siddharthnegi]

thanks for the reply can you tell me how can i do that