Hi,
I installed and configured UF on a Linux server to send syslog to Splunk HF. I am now trying to send an application log also on the same server, say it's in /opt/application/applog.log, to the HF. What I need to modify on the UF .conf file(s) ?
Thanks.
If universal forwarder is already connecting to heavy forwarder then you can just add a MONITOR input to forward applog.log in inputs.conf on UF.
[monitor:///opt/application/applog.log]
disabled = false
index = <index_name>
sourcetype = <sourcetype_name>
crcSalt =
If universal forwarder is already connecting to heavy forwarder then you can just add a MONITOR input to forward applog.log in inputs.conf on UF.
[monitor:///opt/application/applog.log]
disabled = false
index = <index_name>
sourcetype = <sourcetype_name>
crcSalt =
Thank you.
you are welcome 🙂