OK this sounds pretty embarrassing. I have set up quite a fair bit of Splunkforwarders previously but now I some of my newly configured forwarders are unable to forward the logs to the indexers (or the indexers are unable to index the logs forwarded).
This is what is in my inputs.conf in $SPLUNK_HOME$/etc/apps/iis/local/ in the server where my forwarder is installed.
[install] state = enabled
[monitor://D:\Logs\]
disabled = 0
followTail = 0
index = project_index
blacklist = .(1|2|3|4|5|6|7|8|9|0)$
sourcetype = project_logs
The issue here is that this particular forwarder is able to send perfmon logs to the indexer, but is unable to read this particular inputs.conf file.
My search at the search head is simply <code>index = project_index | stats count by sourcetype</code>, but I'm not seeing the project_logs sourcetype appearing at all, only apart from the perfmon sourcetype.
Am I missing anything here?
Regards
