Now, we will configure an inputs.conf file to monitor log files and send the entries to Splunk for indexing. In this example case, we have installed a forwarder on an Apache web server running on a Linux host; the web server log files reside in the /var/log/httpd directory – you can see that there is an active and a rolled-over log for both the access and error logs:
[root@ip-172-31-39-242 httpd]# pwd/var/log/httpd[root@ip-172-31-39-242 httpd]# ls -l-rw-r--r-- 1 root root 86698 Aug 5 22:24 access_log-rw-r--r-- 1 root root 576950 Aug 5 02:43 access_log-20180805-rw-r--r-- 1 root root 1000 Aug 5 14:08 error_log-rw-r--r-- 1 root root 3374 Aug 5 03:16 error_log-20180805
To monitor these logs, we need to edit the inputs.conf ...
