Getting Data In

WIndows Splunk Forwarder

macwin
Explorer

Currently, during the installation of splunk forwarder, at one place it takes input of the directory path or file path of the log file to be indexed. Suppose my log files are in 2 different directories. How can I use both of them for indexing?

Thanks.

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Are you asking how you'd set up your splunk forwarder to monitor multiple files that happen to exist in different directories on the same server? In inputs.conf you would just have two entries like this:

[monitor://C:\somedirectory\anotherone\test.log]
index = myindex
sourcetype = mysourcetype

[monitor://C:\mydirectory\somethingelse\file.log]
index = myindex
sourcetype = mysourcetype

sdaniels
Splunk Employee
Splunk Employee

If you do this through the Splunk UI it will create that inputs.con file for you in \etc\system\local. If you want to do it manually in the config file just create the file yourself add the appropriate settings after looking in our docs and restart splunk on the forwarder.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs

0 Karma

macwin
Explorer

Thanks. I dont have this entry for the file I am currently indexing, then also I can read it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...