• Apps & Questions
• Apps
• Questions
• Users
• Tags

# monitoring text based log file on windows

 0 Hi, I have following input.conf in an app on my deployment server [Monitor://%product_home%\logs\stdout.log] disabled=0 followtail=0 sourcetype=product_stdout index=product_logs  The app deploys to the target server fine, and i also have a forwarding app which also deploys fine (I am also monitoring windows event logs, and these appear in the index no problem, so I know both this and the forwarding app work correctly) However, my stdout.log doesn't seem to be making it into the product_logs index (the index does exist) I have seen mention of accessing https://localhost:8089/services/admin/inputStatus/TailingProcessor%3AFileStatus on the target server, but I get prompted with a login box with no idea what credentials to enter in. likewise if i run the equivalent request from the command line, i get prompted to enter a username and password. after it fails i get a 401 unauthorized error. I have tried various combinations ... [Monitor://\$product_home\logs\stdout.log] [Monitor://c:\really long path\in here\logs\stdout.log] [Monitor://%product_home%\logs\stdout.log]  To no avail. stdout.log does exist and has content, there are no special permissions on the file and the Splunk agent is running as local system %PRODUCT_HOME% is defined on the target server as a system environment variable, and is in use by other programs, so I know the path is valid. The splunkd.log doesn't appear to have anything useful to tell me other than the app deployed ok. I am sure this must be something incredibly simple that I am missing, but I can't see it for the conf. Halp? asked 16 May '12, 02:31 Conradj 140●4 accept rate: 0% If you didn't change the default credentials to anything else, the ones you should use are "admin" as username and "changeme" as password. (16 May '12, 05:14) Ayn

 0 Some ideas: Search for something that you know is in the data over all time. Perhaps there is a timestamp problem, and the data is really in there, but not at the time you expect. Search index=* for that data. It shouldn't have happened, but what the heck. Is the data recent? If it is older, or has widely varying timestamps, you may need to set some rules in props.conf. Put them in props.conf on the indexer if you are using the Universal Forwarder. Look at the settings for MAX_DAYS_AGO, MAX_DAYS_HENCE, MAX_DIFF_SECS_AGO and MAX_DIFF_SECS_HENCE in props.conf answered 16 May '12, 11:14 lguinn ♦ 10.9k●5●7●23 accept rate: 28%
 toggle preview

Markdown Basics

• *italic* or _italic_
• **bold** or __bold__
• image?![alt text](/path/img.jpg "Title")
• numbered list: 1. Foo 2. Bar
• to add a line break simply add two spaces to where you would like the new line to be.
• basic HTML tags are also supported

Tags:

×433
×168
×106
×42
×3