Hi: I'm using Splunk in a Mac OS X system. I've installed Universal Forwarders in several Windows Machines. I 've used the installer's GUI for the forwarders, customised the options to monitor a folder and data IS getting into Splunk Server. But when I check the Universal Forwarders etc/system/local/inputs.conf file I only see 2 lines [Default] and Host name. Nothing there about the directory I'm supposed to monitor in the server. As I've said, data IS getting into the server, but I get the "no source type for this job" error when trying to extract fields. So I was wondering if should I trust the GUI to add a Data Input for a Directory in the managed forwarders (they also show OK in the Server's console), or just tweak the inputs.conf file locally in each forwarder to add the source type field there. If I add a data input in the server GUI, is that configuration written anywhere in the remote universal forwarder ? Thanks! ... View more

sorry about this but I'm new to Splunk: I have a folder where log files coming from several computers are stored. All of them have event data that I have to process. Each log file has the name of the host computer in its file name, and also has some event within, with that computer name like "Desktop_A". What I'm trying to summarise is the total of a given event like "Notepad.exe is open" from a log that writes the message once per minute (if the application I'm searching for is really open) in each of these log files doing a summary by the hour. If I find "Notepad.exe is open" 60 times in an hour I calculate 100% usage for that hour, etc. My main problem is that I can do it with one log file, but gets more complicated than that because the directory receives new log files each day from hundreds of computers. My goal is to represent application usage per hour (as percentage of time) for each one of the computers that I have log files for (and remember, the directory can have multiple log files for the same computer). The places where I can get the computer name are the log file itself (the name has a string identifying the PC) or an event in some of the rows of the log itself. The things I've managed to do is to monitor the directory, extract the field I look for and do some aggregation but for a single computer with a single log file in tests. I need some general help about how to tackle de problem. Thanks a lot and sorry. I've searched the forum but I find lots of technical SPL questions but I need something more basic... ... View more