I would like to forward my symfony logs using a Splunk universal forwarder. I ran a train on a sample symfony log file on my indexing machine, however I don't see my logs getting forwarded from the universal forwarders.
Do I have to do a train on the universal forwarders as well? When I added the files to be monitored on the forwarders I did have to specify a sourcetype ("symfony") that it didn't know about.
How does this work?
Thanks!
Never mind, there was just nothing coming into the log file. Once I sent some data in there, it got sent over properly.
Never mind, there was just nothing coming into the log file. Once I sent some data in there, it got sent over properly.
What did you use for a sourcetype