I have the following entry on the inputs.conf on the Universal Forwarder App to collect all the windows task scheduler log:
disabled = false
sourcetype = WinEvent:TS
and I have the following entry on the HF app props.conf just to route them to the correct index cluster
TRANSFORMS-routing = routeMe
Other logs on the same server with the same routing are coming in just fine, but I don't see a single event for the task scheduler even though we can see new events on the event viewer every minute or so.
There's no error message on the splunkd.log, and I can see the following entry on the metrics.log
06-20-2019 22:20:57.646 +1000 INFO Metrics - group=per_sourcetype_thruput, series="wineventlog:microsoft-windows-taskscheduler/operational", kbps=0.259293, eps=1.032258, kb=8.038086, ev=32, avg_age=1.000000, max_age=1
So I suppose it should have been coming in somewhere, but I just couldn't find it. It's not there on the target index nor the default index. Now I'm not entirely sure if it's actually being read.
The splunkforwarder is already running as a "Local System" on the box and we're using v6.1.1 at the moment.
Any idea please?
... View more
I need to monitor a file under multiple similar paths, the full path can be dynamic so putting absolute path is not an option.
Actual path example: E:\OpenPages\profiles\OpenPagesNode1\logs\OpenPagesNodeServer2Server3\http_error.log
So I have the following monitor stanza and it doesn't pick up the files. Nothing useful in _internal log which indicate any problem.
I suspect it's due to multiple wildcards on the path, since other file with similar stanza picked up just fine, as below,
I can't really play around with it at the moment, but I'm pretty sure it'll work if I use the following monitor stanza instead,
But I want to avoid it if possible since it will force the forwarder to traverse through all irrelevant subdirectories.
Any good suggestion?
... View more