Seems my answer got cut off. Anyway, I put your suggestion for the props.conf and the inputs.conf in the files and restarted splunk. Still wont collect anything sadly. ... View more

Hi again, Tried your suggestions, probably I am doing something wrong because I get no data collected. Here is what I have done: On both the Splunk server and the UF, created the file "props.conf" in C:\Program Files\SplunkUniversalForwarder\etc\system\local\ Contents of props.conf: LINE_BREAKER = ([\r\n]+)\s?\ ... View more

Thanks, will try to do this during the week! I noticed there are a lot of props.conf on the server, which one is the one I am supposed to edit? The documentation say you should edit the file in $SPLUNK_HOME/etc/system/local/ I don't have any props.conf in that location, am I supposed to create a new file at that location? Or should I make a copy of the one in "C:\Program Files\Splunk\etc\system\default" and add the things you suggested in that file? ... View more

Hi, just so I am understanding you correctly, I am as I said very new to Splunk: You are suggesting to not use Splunk at all in this particular case? Or is it some app that gives the functionality of version control? ... View more

Thanks for taking the time to help. Below is a portion of the start of the file, and some part that contain the data that is interesting to monitor: The start of web.config: <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /> <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /> <!-- DYNAMIC DEBUG COMPILATION Set compilation debug="true" to enable ASPX debugging. Otherwise, setting this value to false will improve runtime performance of this application. Set compilation debug="true" to insert debugging symbols (.pdb information) into the compiled page. Because this creates a larger file that executes more slowly, you should set this value to true only when debugging and to false at all other times. For more information, refer to the documentation about debugging ASP.NET files. --> <compilation defaultLanguage="c#" debug="false" targetFramework="4.5.2"> <assemblies> <add assembly="Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /> <add assembly="System.Data.OracleClient, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /> <add assembly="System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /> <add assembly="System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /> <add assembly="System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /> <add assembly="System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" /> </assemblies> </compilation> The data I am interested in monitoring in the file: <endpoint address="net.tcp://localhost/SECRET/Services/SecurityServices/AuthorizationService.svc" binding="netTcpBinding" bindingConfiguration="NetTcpBinding_IAuthorizationService" contract="AuthorizationService.IAuthorizationService" name="AuthorizationService" /> <endpoint address="https://secret.domain.com/Services/PServices/ESSBasic.svc" binding="wsHttpBinding" bindingConfiguration="secureWsHttpBinding" contract="ESSBasicService.IESSBasic" name="BasicHttpBinding_IESSBasic" /> <endpoint address="https://secret.domain.com/Services/PServices/ESSFlex.svc" binding="wsHttpBinding" bindingConfiguration="secureWsHttpBinding" contract="ESSFlexService.IESSFlex" name="BasicHttpBinding_IESSFlex" /> </client> <clear /> <add key="ConfigInNeptune" value="True" /> <add key="DBAPISection" value="RE_ODBC" /> <add key="DBPath" value="D:\Visma\Programs\Ciceron\" /> <add key="NeptuneConnectionName" value="SECRET" /> <add key="NeptuneSSO" value="False" /> <add key="PathToTravel" value="" /> <add key="TurbyteRastVarning" value="True" /> <add key="ActionLog" value="True" /> <add key="SkickaEmailFrMeddBemRes" value="True" /> <add key="VarningGammalAvvTjg" value="True" /> <add key="ShowRetro" value="True" /> <add key="ShowDoctorInterface" value="True" /> <add key="CheckOverDraft" value="True" /> <add key="ArbtBemFranvorsak" value="False" /> <add key="AlltidKostAvdrag" value="False" /> <add key="CheckCompensatoryBalance" value="-1" /> <add key="ProxyPath" value="" /> <add key="CheckAbsenceHighErrorMsgLevel" value="False" /> <add key="OblArbStalleVidKonto" value="False" /> <add key="WindowsIdentityFoundationEnabled" value="True" /> <add key="VismaWindowOnly" value="False" /> <add key="AMRunInIframePath" value="" /> <add key="AMDashBoardPath" value="/SECRET/Dashboard/Home/Get/1" /> <add key="AMSaldoTileMaxOkomp" value="50" /> <add key="AMSaldoTileShowSem" value="True" /> <add key="AMSaldoTileMaxOtid" value="200" /> <add key="AMFlexTileUseButtons" value="False" /> <add key="ESSBasicServiceLink" value="http://localhost/PWeb.Services/ESSBasic.svc/Web/" /> <add key="ValidationSettings:UnobtrusiveValidationMode" value="None" /> <add key="WIFLogoutLink" value="" /> <add key="TravelShowHigherCompensationWarning" value="False" /> My infrastructure regarding Splunk is basically just a single standalone server that will be collecting data from other servers in the same domain using forwarders that are installed on the hosts. Simplest possible installation in other words. ... View more

That is a good idea, but not what I want to do in this case. My problem is not multiple people touching configuration files, it is that the application itself when it gets updated adds lines that are wrong, or just flat out deletes data. This would be nice to be able to see in splunk. ... View more

Hi, yes, from what I can see they are configured exactly the same. I've tried looking at those links before I posted here, it does not shed any light on how this is supposed to be configured, at least not to a rookie Splunker like me. I take it that I will have to create a brand new sourcetype in the props.conf file on the host with the file I want to monitor? ... View more

Hi, thanks for the answer. Ok, In splunk - Add data Forward data from Splunk forwarder - Selected my host and serverclass Files & Directories - Enter the path to the file I want to index, using local path on the server that has the file. next next done. This works if I put in the path of a file with the extension .log, but if I enter a file with the extension .config, nothing shows up anywhere. ... View more