Getting Data In

How to edit my inputs.conf on a Windows universal forwarder to forward NPS/IAS logs to my Linux indexer?

swannie
New Member

Hi all,

I'm new to Splunk and I'm having a problem getting the Universal Forwarder on Windows to forward Microsoft NPS/IAS logs to my Linux-based indexer server. I successfully have DHCP logs being forwarded and indexed from the servers in question (so I think I'm doing it right.) and if I look in the Splunk logs, it tells me that it's monitoring the directory in question, however, none of the logs seem to make it to the server.

Here's my inputs.conf:

[monitor://C:\Windows\System32\dhcp]
sourcetype = dhcp
crcSalt = <SOURCE>
alwaysOpenFile=1
disabled = false
whitelist = DHcp.+.log

[monitor://C:\Windows\System32\LogFiles]
sourcetype = ias
crcSalt = <SOURCE>
alwaysOpenFile=1
disabled = false
whitelist = IN*.log

... everything looks right to me, and as I said the DHCP logging is working great. I'm at a loss as to where I can look to troubleshoot further. Thanks for the assistance!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Change the whitelist from whitelist = IN*.log to whitelist = IN.*\.log

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Change the whitelist from whitelist = IN*.log to whitelist = IN.*\.log

swannie
New Member

Yup - I knew it was going to be something simple, and that was it. Being primarily a Linux person I'm a little embarrassed I didn't think of that. Since it was on Windows, RegEx didn't even enter my mind! 🙂

Thanks so much!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...