Getting Data In

WIndows Splunk Forwarder

macwin
Explorer

Currently, during the installation of splunk forwarder, at one place it takes input of the directory path or file path of the log file to be indexed. Suppose my log files are in 2 different directories. How can I use both of them for indexing?

Thanks.

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Are you asking how you'd set up your splunk forwarder to monitor multiple files that happen to exist in different directories on the same server? In inputs.conf you would just have two entries like this:

[monitor://C:\somedirectory\anotherone\test.log]
index = myindex
sourcetype = mysourcetype

[monitor://C:\mydirectory\somethingelse\file.log]
index = myindex
sourcetype = mysourcetype

sdaniels
Splunk Employee
Splunk Employee

If you do this through the Splunk UI it will create that inputs.con file for you in \etc\system\local. If you want to do it manually in the config file just create the file yourself add the appropriate settings after looking in our docs and restart splunk on the forwarder.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs

0 Karma

macwin
Explorer

Thanks. I dont have this entry for the file I am currently indexing, then also I can read it.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...