The universal forwarder has a very simple configuration of what to scan for (inputs.conf) and where to send it to (outputs.conf). Splunk indexer has the following in props.conf [source::.../....log4j] sourcetype = log4j I want every *.log4j file to have "log4j" sourcetype but it doesn't work when receiving information from the forwarder. For example, I see the following from "summary" screen in indexer: source: /data1/packages/apache-tomcat/logs/splunk/splunk-test/app.log.2011-04-04.log4j sourcetype: app.log How can I have "app.log.2011-04-04.log4j" to be assigned "log4j" sourcetype? ... View more

No migrations, no upgrade, installing forwarders from the ground up. from splunkd.log **ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf** etc/system/local/outputs.conf [tcpout] defaultGroup = splunk server = log1:9997 compressed=true etc/system/local/deploymentclient.conf [target-broker:deploymentServer] targetUri = log1:9997 etc/system/local/inputs.conf [monitor:///[my folder path]/splunk-test] disabled = false followTail = 0 index = default Splunk on log1 works fine. ... View more