So I've read the docs on how to properly format a monitor stanza in Windows.. and am trying to monitor a dir full of csv files. Here's the stanza:     # Windows Log Processor [monitor://C:\Users\user\Desktop\ICTExports\*.csv] disabled = false crcSalt = <SOURCE> ignoreOlderThan = 2d index = it_app_ict sourcetype = csv      I added the crcSalt bit because without it the files in the monitor directory were generating the seekptr errors since the first few lines in all the files are identical. And here's the error in splunkd.log:     10-05-2022 10:25:25.768 -0500 INFO TailingProcessor [3624 MainTailingThread] - Parsing configuration stanza: monitor://C:\Users\user\Desktop\ICTExports\*.csv. 10-05-2022 10:25:25.768 -0500 INFO TailReader [3624 MainTailingThread] - State transitioning from 1 to 0 (initOrResume). 10-05-2022 10:25:25.768 -0500 INFO TailReader [3624 MainTailingThread] - State transitioning from 1 to 0 (initOrResume). 10-05-2022 10:25:25.768 -0500 INFO TailingProcessor [3624 MainTailingThread] - Adding watch on path: C:\Users\user\Desktop\ICTExports.       So it's been ~5 minutes since I last restarted the service and there's no further mention of the monitor path nor any of the .csv's within it. There is one file that falls within the 2d period so Im expecting it to be read. What can I do?   Thanks! ... View more

So a few days ago I typo'd the index name in the inputs.conf file on serverA running the universal forwarder, and inadvertently sent the log data to IndexB. We discovered it a few hours ago and since then I have verified multiple times that serverA's inputs is correct now, restarted splunk. It's been about an hour and this one inputs stanza is still somehow forwarding log data to IndexB instead of IndexA.  I have grepped splunkd.log but all I can see is it parsing the monitored file correctly..nothing about it's destination index. Any help would be appreciated! ... View more

I have a Universal Forwarder accepting syslog traffic from multiple sources.  The UF forwards up to indexers in Splunk Cloud. My question is two-fold:   If I need an Add-On like for VMware ESXI Logs. Do I install that on the UF or request installation in Splunk Cloud? And if the latter, how does my UF know that I can now use any new sourcetypes?  I've read through the installation notes on a few Add-Ons and have not seen mention of how new sourcetypes are used outside of the server or instance the add-on is directly isntalled.   Thanks! ... View more

Last night I installed the UF onto a system hosting some docker containers. I wanted to grab the log files without modifying the existing containers config so I created symlinks to the container logs (/var/lib/docker/containers/<name>) in /var/log.  Then set the stanzas in inputs.conf to look at those symlinks. Bounced the app and waited about half an hour, nothing.  I was searching and found references to followSymlinks, so I added that to each stanza as 'true'. It's been ~7 hours and nothing yet. What did I do wrong here? ... View more

Hi all! So I am helping the networking team transition their logging to Splunk and last week I discovered the Cisco Meraki Add-on.  Also discovered that in order to install the add-on as well as configure any part of it; connection, inputs, etc.. that I needed a pretty high permission level.  (requires capacity: admin_all_objects) Since I am not a Splunk "admin" here at work.. I am wondering if there an existing role that might allow me to configure add-ons but not allow me to manage "all_objects"? Our actual Splunk Admin is a super busy guy so I am trying to help him out on this. I do have a higher level of access than most but all objects on an add-on seems incredibly silly. Thanks!! ... View more