hi I have configured few forwarder agents through deployment server. I have given inputs.conf through app. here i need to monitor particular log file from directory and the same directory has a few other files too. here is my inputs.conf [monitor : //directory\log\log.txt] disabled=false sourcetype=XXXX index=XXX so here i have to monitor that log file from few agents. But splunk it is monitoring the different file from the same path. source: //directory\log\anotherlog.txt. ... View more

Hey everyone, I have installed UF agents in 180 servers and i have seen the data coming to splunk yesterday. But now i have noticed three of them are not sending data, I mean i am seeing 177 hosts in splunk. So how can we find out what are those three UF's which is not sending data. I have configured all these using Deployment server. Same index and same sourcetype. And is there a way that we can get alerts when the forwarder stops sending data or gets any issue? I am using splunk 6.3. Thank you ... View more

Hello Splunk Experts, I have an issue with dashboard panels, I have a metrics(CPU) dashboard which populates to another dashboard panel with default drill down options. When I click on CPU dashboard panel it must show data in another tab, the issue here is, its opening the new tab showing the given default drill-down options, but instead of populating data its showing the error "search is waiting for input". I have the same issue with all the panels in that dashboard. But when I give the drill-down options manually its populating the data. I am confused why its not working automatically when i click on any panel but why its working manually. Thank you ... View more

I have a bunch of agents(hosts) in Appdynamics, I wanted to figure out that the Universal Forwarder is installed or not in all those hosts to collect logs to Splunk. Is there any way that I can get the list of hosts that installed with UF. Thanks in advance. ... View more