Splunk 7.x Quick Start Guide

Configuring inputs.conf

Now, we will configure an inputs.conf file to monitor log files and send the entries to Splunk for indexing. In this example case, we have installed a forwarder on an Apache web server running on a Linux host; the web server log files reside in the /var/log/httpd directory – you can see that there is an active and a rolled-over log for both the access and error logs:

[root@ip-172-31-39-242 httpd]# pwd/var/log/httpd[root@ip-172-31-39-242 httpd]# ls -l-rw-r--r-- 1 root root 86698 Aug 5 22:24 access_log-rw-r--r-- 1 root root 576950 Aug 5 02:43 access_log-20180805-rw-r--r-- 1 root root 1000 Aug 5 14:08 error_log-rw-r--r-- 1 root root 3374 Aug 5 03:16 error_log-20180805

To monitor these logs, we need to edit the inputs.conf ...