Deploying app to collect IIS logs. When restarting the forwarder get the following:
" Invalid key in stanza [monitor:E:\AirWatch\Logs\IIS\] in E:\SplunkUniversalForwarder\etc\apps\IIS\default\inputs.conf, line 7: whitelist (value: \.log$). Your indexes and inputs configurations are not internally consistent
"
Runninf splunk btool gives no further info.
Here is the entire inputs.conf:
[monitor:e:\AirWatch\Logs\IIS
disabled=false
sourcetype=iis
whitelist=\.logs$
Hey check the syntax of monitor stanza
[monitor://e:\AirWatch\Logs\IIS]
disabled = 0
sourcetype = iis
whitelist = \.logs$
You need to add your path after [monitor://<your_path>]
Also to monitor file with the .log
extension, you should write \.log$
You can find this in
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Whitelistorblacklistspecificincomingdat...
Let me know if this helps!
try this:
[monitor://e:\AirWatch\Logs\IIS]
disabled = 0
sourcetype = iis
whitelist = \.logs$
You got it! Sorry I can't mark your answer as accepted. Someone else beat you by 4 minutes!
Thanks!!
Hey check the syntax of monitor stanza
[monitor://e:\AirWatch\Logs\IIS]
disabled = 0
sourcetype = iis
whitelist = \.logs$
You need to add your path after [monitor://<your_path>]
Also to monitor file with the .log
extension, you should write \.log$
You can find this in
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Whitelistorblacklistspecificincomingdat...
Let me know if this helps!
That did it. Pretty stupid on my part!
Thanks!!