Hi, Can someone please help guide me based on experience? What is the best mechanism to stream data to Splunk? As part of our organization we have built a custom logger service that can make a REST call (internally this service would then use HTTP event collector) and send data to Splunk. Some of these apps had issues in Splunk HTTP collector with JavaScript/typescript. The constraint with forwarder is that many of these apps have multiple clients wherein it might be difficult to achieve a Forwarder setup. Lastly, with UDP we have seen few reviews that show event loss issues. Thanks ... View more

Hi, I wish to configure splunk forwarder to pick logs from a directory that match any of the below patterns. Essentially anything that matches the regex "/^(jacket.)?[^\.]*-[^\.]*(.jvm)?.log$/" . I tried to make below changes to inputs.conf but it is not working as expected. Can someone help guide how to debug further ? may start with “jacket.” must have at least one hyphen must end in “.log” or “.jvm.log” must not have any other “.” characters Inputs.conf [monitor:///base/apps/logs] disabled = false index = test sourcetype = _json whitelist = ^(jacket.)?[^\.]*-[^\.]*(.jvm)?.log$ blacklist = \.gz$ ... View more

Hi all, I was trying to configure a log pattern main.log from using recursive option. However splunk is failing to pick up any new files created and I dont see any errors as part of the _internal log as well. When I tried to enable the recursive option for it seemed to work fine. Is there any workaround or solution to fixing this ? From what I saw wildcard or regex also do not allow more than 2 directories. index = app_elixir_rg recursive = true sourcetype = elixir whitelist = main.log ... View more