I have added monitoring with below command on my windows client. ./splunk add monitor C:\path\to.log -index qa -sourcetype pcs_log -host <ip> I can see above path in monitored file list when I execute splunk list monitor . As per my understanding splunk add monitor adds below stanza in inputs.conf. Isn't it? But I am unable to find these lines in any of inputs.conf file. I have checked /etc/system/local/inputs.conf but it doesnt have these values. [monitor://path/to.log] disabled = 0 setting1 = value setting2 = value ... I am using splunk cloud and installed universal forwarder. can you please help? ... View more

Hi I am newbie. I have installed splunk universal forwarder on windows client to forward log on Splunk Cloud. When I run below command, it executes without any error. But when I check /etc/local/inputs.conf file there is no section of monitor. /splunk add monitor "D:\SGN" -index qa -sourcetype test_log -host <myip> Also, If I execute list monitor command then also it shows monitored directory. How do I debug or find out whats wrong. Note: I am creating AWS EC2 instance by passing UF installation scripts in userdata. in case, if it makes any difference. ... View more

We are using Self service Splunk cloud and we do not have access to CLI. In addition, we are not using any deployment server. Splunk Cloud store its internal audit log on cloud. How do I forward these internal audit log to third party system? ... View more

We are using self-service Splunk Cloud. and all clients are using UF to directly send data to self-service Splunk Cloud. UF -------> self-service Splunk Cloud Now, management is requesting to forward some of security logs to third party application. From my little knowledge, I found 2 solution to this problem. Can you help me understand best approach? By using SDK and REST API through program Use intermediate Forwarder(not HF, just UF) to identify security log and send it to both self-service Splunk Cloud as well as thirdparty app. I am unsure about one thing in point #2. i.e. how do I configure intermediate UF to route same data to two different source (1. cloud and 2. thirdparty app). Can you please help with best approach and solution to point #2. ... View more

I am new to splunk. My organization is using Splunk SaaS and I have been asked to setup forwarder to forward logs to Splunk Cloud. Can anyone help me find documentation or ebook on Splunk SaaS? I tried on google but unable to find any. ... View more