I am attempting to add the DHCP and RADIUS logs on a server installed with the Splunk Forwarder.
I have the following configured within C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\input.conf and restarted the forwarder service.
###### DHCP ######
[monitor://C:\Windows\System32\DHCP]
disabled = false
whitelist = Dhcp*.log
crcSalt = <SOURCE>
sourcetype = Dhcp
alwaysOpenFile = 1
###### RADIUS ######
[monitor://C:\Windows\System32\LogFiles]
disabled = false
whitelist = IN*.log
crcSalt = <SOURCE>
sourcetype = RADIUS
alwaysOpenFile = 1
I cannot see any of that data within Splunk. What am I missing?
... View more