Monitoring a file from a PC
Manual by editing agent on the machine you want to monitor
File location
C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\input.config
If in the installer you have it monitoring the event viewer alerts the file should contain
To monitor the file location add this to the above file
[monitor://C:\Users\j.hollon\Desktop\moniterMe]
disabled = false
index = <name me>
sourcetype = <anything>
recursive = true
Log to see if it is sending to splunk indexer
C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log
Resources
Last updated