I am attempting to add the DHCP and RADIUS logs on a server installed with the Splunk Forwarder.
I have the following configured within C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\input.conf and restarted the forwarder service.
###### DHCP ######
[monitor://C:\Windows\System32\DHCP]
disabled = false
whitelist = Dhcp*.log
crcSalt = <SOURCE>
sourcetype = Dhcp
alwaysOpenFile = 1
###### RADIUS ######
[monitor://C:\Windows\System32\LogFiles]
disabled = false
whitelist = IN*.log
crcSalt = <SOURCE>
sourcetype = RADIUS
alwaysOpenFile = 1
I cannot see any of that data within Splunk. What am I missing?
Just this command in input.conf
[monitor://C:\Windows\System32\DHCP\Dhcp*.log]
disabled = 0
You might still have an other inputs.cong file taking precedence over the one you listed above. Check /system/local and any other apps.
make disabled = 0 & see the results.