strangely nothing again. /opt/splunkforwarder/bin/splunk cmd btool inputs list --debug | grep forwarder | grep -v splunkforwarder ... View more

strange part is the server which is working fine has no monitor parameter set in any of the inputs.conf /opt/splunkforwarder/bin/splunk list monitor Monitored Directories: $SPLUNK_HOME/var/log/splunk /opt/splunkforwarder/var/log/splunk/audit.log /opt/splunkforwarder/var/log/splunk/first_install.log /opt/splunkforwarder/var/log/splunk/splunkd_access.log $SPLUNK_HOME/var/log/splunk/license_usage_summary.log $SPLUNK_HOME/var/log/splunk/metrics.log /opt/splunkforwarder/var/log/splunk/metrics.log $SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log* $SPLUNK_HOME/var/log/splunk/splunkd.log /opt/splunkforwarder/var/log/splunk/splunkd.log $SPLUNK_HOME/var/log/watchdog/watchdog.log* /var/log/forwarder-logs /var/log/forwarder-logs/LogA /var/log/forwarder-logs/LogB /var/log/forwarder-logs/LogC /var/log/forwarder-logs/LogD /var/log/forwarder-logs/LogE /var/log/forwarder-logs/LogF /var/log/forwarder-logs/LogG /var/log/forwarder-logs/LogH /var/log/forwarder-logs/LogI /var/log/forwarder-logs/LogJ Monitored Files: $SPLUNK_HOME/etc/splunk.version $SPLUNK_HOME/var/run/splunk/search_telemetry/*search_telemetry.json $SPLUNK_HOME/var/spool/splunk/...stash_new grep -r "/var/log/forwarder-logs" /opt/splunkforwarder/etc/ Above command returns nothing. ... View more

Thanks @richgalloway for the prompt response. I have been through both the links earlier. We won’t be using lambda for now. For the other one aws cloud watch config is the part of universal forwarder? What should be the input and output.conf files? Also how do I add source in splunk server? Is it the way it is in lambda method blog? ... View more