I have created several reports. I am curious as to which file the script is edited in. (Or which file is modified or created to control and provide the configuration for these reports for the web interface.) Is is in the same config file as the default reports and if so which config is it. Thanks. ... View more

I'm trying to monitor a log file to a splunk universal forwarder. For example the splunkd.log file. I've tried getting into the inputs.conf file on the machine with the universal forwarder intstalled and adding [monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]. I can't see the log file on the main reciever. What am I missing here? Please help.... ... View more

Could anybody tell me how to work with the inputs.conf file of a forwarder to set the forwarder to start/stop/index every X amount of time rather than in real time? The cron was mentioned but I'm not so sure how to use it and the documentation is a bit foggy. I basically want the forwarder to start up every X hours and push the latest log file data to the receiver if possible. Thanks all! ... View more

Is there any way to have a forwarder process not constantly running but rather start up every x hours or so? I'm trying to avoid tying up to many resources on the server as the Splunk universal service seems to constantly consume 65MB of memory. ... View more

I have 3 servers each with a log file. I am planning on installing a universal forwarder on each server to push the info in these files to the receiver on the main server. Currently the log files gather no more than 5MB a day. They currently aren't getting large enough to turn over and start a new log file. My thoughts were to use the batch input type to drop the file into the Splunk directory, index it, and delete it. However because these logs aren't turning over enough I am worried getting duplicate event data. Thus, I am focused on real time forwarding on each server but concerned with the amount of resources that each forwarder will consume. With this in mind, is it better to constantly run the forwarders to avoid duplicate data, or is there another way to get the log files indexed while avoiding duplicate event data? ... View more