We are trying to monitor a specific .log file in Windows 2k3 and 2k8. For example:
D:\logfiles\log123.log
We opened the "D:\Program Files\Splunk\etc\system\local\inputs.conf"
Then added the line:
[monitor://D:\logfiles\log123.log]
Saved the file, restarted the service and waited. No data from that path came into the splunk server. It is reporting data from the WMI Security logs, but not the path stated above. We DONT want to reinstall the forwarders on every machine every time we need to make a change (we plan to use a deployment server in the future too). I read that this is possible but can't figure out why it isn't work.
Any help would be greatly appreciated. Thank you.
The inputs.conf looks correct. Please restart splunk and check the internal logs in %SPLUNK_HOME%\var\log\splunk\splunkd.log for any errors or warnings.
I looked in the var\log\splunkd.log file for errors and we are seeing this immediately under the specified path:
BatchReader = State transitioning from 2 to 0 (initOrResume).