Hi,
I am trying to get logs from two different servers running Tomcat application, but have the same location. The following is the inputs.conf
[default]
host = $decideOnStartup
[monitor://C:\Tomcat\logs\]
disabled=false
sourcetype=access_combined_wcookie
index=globalscreening
whitelist=localhost_access_log.*txt$
[monitor://C:\Tomcat\logs\app-errors.log]
sourcetype=catalina
index=globalscreening
[monitor://C:\Tomcat\logs\app-events.log]
sourcetype=catalina
index=globalscreening
[monitor://C:\Tomcat\logs\ws28.log]
sourcetype=catalina
index=globalscreening
The issue is I am getting logs into Splunk from server A, but not from server B. I have tried to include host information into the above stanza, but the logs stopped ingesting into Splunk.
Could you please let me know where I am going wrong and how to correct it?
thank you.
... View more