In Windows I have the following in the Inputs.conf:
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\]
disabled = 0
whitelist = ERRORLOG.*
recursive = false
However the ERRORLOG file is not showing up in splunk. I have other data and files that I can get to go in there but not this. I see no errors in the splunkd.log. How do I troubleshoot this?
It looks like you're trying to monitor a directory, but not recurse into any of the files within it. Try splunk list monitor
and see if your ERRORLOG file shows up.
You don't really need a whitelist here anyway - you can use wildcards in the monitor
definition. You should be able to just use a wild card in the path:
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\ERRORLOG.*]
disabled = 0
It looks like you're trying to monitor a directory, but not recurse into any of the files within it. Try splunk list monitor
and see if your ERRORLOG file shows up.
You don't really need a whitelist here anyway - you can use wildcards in the monitor
definition. You should be able to just use a wild card in the path:
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\ERRORLOG.*]
disabled = 0
you can force reload of monitors in inputs.conf without a restart with e.g., ./splunk _internal call /data/inputs/monitor/_reload -auth admin:changeme
Okay, figured out I have to restart the service. I was just missing a directory at the end.. but that command is still very helpful, thanks!
IIRC it depends on how you add the new monitor
entry. If you add it via splunk add monitor
or through the Manager you don't need to restart. If you edit inputs.conf
directly, a restart will be needed.
For that command, do I need to keep restarting the service or does that just read the configuration file?