Getting Data In

Why is collecting remote data not working?

judges88
Explorer

(This may be Vague because what its on so sorry ) I have lets say 2 servers. The "Splunk" server, and then the "Target" server. There are certain logs on the Target server that im trying to get to report to splunk. And for some reason they just arent going. Tried editing the inputs a few times. I get 2 of the 3 files reporting to splunk but for some reason it wont capture the other one. 

Ive tried a few variations on the Inputs.conf file to capture these logs. Not sure if i need to specify the log type in the conf file or if im just being dumb. This is one of those things ive been working on for a while so my mind is mush. So here i am. 


There is a "Banner.LogTypeHere" "Host.LogTypeHere" and a "UserDAC.LogTypeHere" I get the Banner and Host to show up but for some reason the UserDAC doesnt populate. 

Just some dumb variations ive tried in inputs. 

[monitor: %ProgramData%\XXX\XXX\Logs]

[monitor: %ProgramData%\XXX\XXX\Logs\*.LogTypeHere]

[monitor: c:\ProgramData\XXX\XXX\Log]

Labels (4)
0 Karma
1 Solution

judges88
Explorer

Not sure what the final resolution was, came in today after a long weekend and everything was reporting. 

View solution in original post

0 Karma

judges88
Explorer

Not sure what the final resolution was, came in today after a long weekend and everything was reporting. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does Splunk have access to all of the files it is trying to monitor?  Can you install a UF on the Target server so the files can be monitored locally?

---
If this reply helps you, Karma would be appreciated.

judges88
Explorer

Sorry for the long delay with the weekend i wanted to take a break from work ahah. But Yes the UF is installed on all of our servers we have. And they all report back to our host Splunk Server. 

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...