Thank you! It did work. This configuration removed the time from the beginning of the Splunk events but there are system timestamps (_time). ... View more

The interval doesn't accept a cron schedule for the Website Monitoring app. Instead, set the cron schedule to the amount of time that corresponds to how often you want the input to run. For example, enter 60s or 1m to get it to run every minute. ... View more

What do you mean by Splunk? I believe are you referring to the Splunk Indexers, the answer is maybe. This all depends on your input. If you are monitoring files the answer is no since the UF will pick up where it left off last. Though that does not protect against in-flight data loss. You can protect against in-flight data lost by using indexer acknowledgment. If you data is streamed such as raw TCP data or Syslog data, yes you could lose data. There are ways to help protect against that. By using indexer acknowledgement and increasing queueSize on both your input.conf and output.conf files. If you have multiple indexer you can use the UFs built in Auto Load Balancing feature. Here is a good post on HA: splunk-disaster-recovery ... View more

🙂 Somehow I misunderstood it in the manual for inputs.conf. Thanks again! ... View more

you will need to configure an inputs.conf file on the forwarder to monitor the file location of your log and send it to your splunk server. in your inputs.conf file on the universal forwarder you would have a stanza something like this: [monitor:///var/log/logfilename] sourcetype = logfile disabled = 0 In this stanza, you basically want to specify the file location of the log file you are monitoring and give it a source type. You can name the sourcetype anything you want, just name it something that makes sense for your environment. You can deploy this inputs.conf file in a couple of different ways. If you are manually configuring everything, you could locate this file in the /etc/system/local area under the universal forwarder file path. If you wan't more granular control you could deploy this configuration as its own app to the universal forwarder in which case it would live under the /etc/apps/app-name/ area under the universal forwarder file path. You can name the app anything you like, it is good to have a functional naming scheme so you know what your apps do just by looking at them. This gets into a whole other area of splunk configurations. A good guide to look through is the splunk "Getting Data in Correctly" guide. ... View more