Thanks, somesoni2! ... View more

Hi Shaun, First of all, it is a best practice to create inputs.conf under app's local folder instead of default. Howerver, this shouldn't be why you are getting in any data. After you made changes to you .conf file on the universal forwarder (uf), have you restarted the instance? If not, I suggest you restart uf to make sure the changes will take effect. On uf, use the following command to view the monitored directories and double-check they are correct: splunk list monitor Hope this helps. Thanks! Hunter ... View more

Hi Ahmed, what is the path to the log file that you find the "weblogic.kernel.Default" messages in? The add-ons can monitor log files from Web Logic. As tsweet said, the best thing to do is look at the inputs.conf configuration in the add-ons and determine if the log files you want to monitor are in those paths. Below are two monitor stanzas from the "Function1_WLS_Managed_nix_TA" inputs.conf file as an example: [monitor:///opt/./.../user_projects/domains/*/servers/*/logs/*.log] [monitor:///opt/./.../user_projects/domains/*/servers/*/logs/access.log] ... View more

check your file permissions. this was my problem. chown splunk.splunk -R ... View more

I have a global of 90days, so just assumed it included _internal. Thanks for the quick response. ... View more

Apparently you need an HTML 5 version of IE. ... View more