Thanks Ayn, For clearing this doubt. Can you please share the steps to configure the Universal Forwarder (ON UNIX) to forward the log file to Splunk. ... View more

OK so what can i do to access the unix logs. please share any reference to configure. ... View more

The script is executable. [root@ ]# tail -3 $SPLUNK_HOME/var/log/splunk/splunkd.log 05-22-2013 18:02:33.349 +0530 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected 05-22-2013 18:02:35.688 +0530 WARN TcpOutputProc - Cooked connection to ip=10.151.9.184:9997 timed out [root@ ]# ping 10.151.9.184 PING 10.151.9.184 (10.151.9.184) 56(84) bytes of data. 64 bytes from 10.151.9.184: icmp_seq=1 ttl=127 time=0.856 ms But i am not sure of the 9997 port. can u tell me where is the file location which will confirm this port on server side ... View more

Hi Drainy, [root@mymachine local]# more /opt/splunkforwarder/etc/apps/SplunkUniversalForwarder/default/inputs.conf [splunktcp] route=has_key:tautology:parsingQueue;absent_key:tautology:parsingQueue [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] _TCP_ROUTING = * index = _internal [script:///opt/splunkforwarder/etc/apps/scripts/bin/top.sh] interval = 5 # run every 5 seconds sourcetype = top # set sourcetype to top source = script:///opt/splunkforwarder/etc/apps/scripts/bin/top.sh [root@mymachine local]# Plz tell me is this fine . ... View more

I want the output of my script should be monitored by the splunk. Means,i Have On Windows machine One splunk server (Lets say it Server) On Many unix or windows machine i have UniversalForwarder installed ( Lets call them Clients ).. i think i have not configured it properly to send data to the windows splunk server. So Now on client there are some scripts which gives some output to a file . I want the splunk server to read this file and i will be able to see the output of this file in my Splunk UI (where i can create dashboards etc.) Please do let me know if you want more detail on this . ... View more