VMware ESXi and vSphere Cluster Management

Monitor and Forward Log Files with Splunk Forwarders

Learn how to configure a Splunk forwarder on Windows to monitor a log file, assign sourcetype and index metadata, forward events, and verify searchable data.

A Splunk forwarder collects machine data on a source host and sends it to a receiving Splunk deployment. In this lesson, you will configure a Windows forwarder to monitor C:\logs\remote_access.log, assign metadata, forward the events to an indexer, and verify that the events are searchable.

This lesson assumes that the forwarder is installed and running, forwarder output connectivity is configured, and you understand basic Windows permissions and Splunk Search Processing Language (SPL).

How Splunk Forwarders Work

A Splunk forwarder is a Splunk component installed on a data source. It collects local machine data and forwards that data to a receiving Splunk deployment.

The indexer is the Splunk component that receives, processes, stores, and makes events available for searching. The forwarder monitors configured inputs; the indexer handles the receiving and storage side of the data flow.

The forwarder's input configuration determines which local files are collected. A file is not automatically forwarded merely because it exists on the Windows host; it must be defined as an input.

Configure inputs.conf

inputs.conf is the Splunk configuration file used to define data inputs, including monitored files and directories.

On Windows, the local configuration path is:

$SPLUNK_HOME\etc\system\local\inputs.conf

SPLUNK_HOME means the installation directory of the Splunk software. For example, if Splunk is installed in C:\Program Files\SplunkUniversalForwarder, the full path would be:

C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf

If inputs.conf does not exist in the local directory, create it as a plain text file. Do not create a file named inputs.conf.txt; Windows may hide extensions in File Explorer, so verify the actual filename.

The local configuration layer is intended for administrator-managed settings and takes precedence over lower-precedence packaged default settings. If another configuration layer has a higher precedence, it can still override a local value, so inspect the effective configuration when behavior does not match the file you edited.

Understand Stanzas and Settings

A stanza is a named, bracketed section in a Splunk configuration file. It identifies an input and contains one or more key/value settings.

[monitor://C:\logs\remote_access.log]
disabled = 0
sourcetype = remote_access_logs
index = remotelogs

In this example, the bracketed line identifies a file-monitoring input. Each setting has a name on the left and a value on the right.

A monitor input watches a file or directory for event data. The stanza path tells Splunk which local file to monitor. The disabled setting controls whether that input is active.

Sourcetype metadata helps identify the format or logical class of an event. A consistent, meaningful sourcetype makes searches, field extraction, and event classification easier.

An index is a logical repository where Splunk stores and searches events. The receiving environment must have the named index available and must allow incoming data to use it.

Example: Monitor a Windows Remote-Access Log

Assume a Windows host writes remote-access activity to C:\logs\remote_access.log. The forwarder should send the events to the remotelogs index and label them with the remote_access_logs sourcetype.

1. Sign in to the Windows host with an account that can edit the Splunk configuration.
2. Locate $SPLUNK_HOME\etc\system\local\inputs.conf.
3. Create the file if it does not exist.
4. Add this stanza:

[monitor://C:\logs\remote_access.log]
disabled = 0
sourcetype = remote_access_logs
index = remotelogs

5. Save the file using plain text encoding.
6. Confirm that the path is exact, including the drive letter, directory names, and filename.
7. Confirm that the account running the forwarder service can read the file.

The monitored file must be readable by the forwarder service account. An administrator who can open the file interactively does not necessarily prove that the Windows service account can access it.

Apply the Forwarder Configuration

After changing inputs.conf, the forwarder must reload the configuration or restart before the new input is active. A restart is straightforward in a lab or maintenance window.

From a Windows command prompt, run:

"%SPLUNK_HOME%\bin\splunk.exe" restart

Run the command with an account that has the required permissions. You can also restart the Splunk forwarder through Windows service management when that is the standard procedure in your environment.

Verify Events in Splunk

Search the receiving Splunk environment after new lines have been written to the monitored file. Filter by both the configured index and sourcetype:

index=remotelogs sourcetype=remote_access_logs

Results should contain events from the configured remote-access log. Check the event timestamps and contents against activity that was written to the file.

The source field represents the originating file path or other input source. If the index contains several sources, narrow the search to the configured path:

index=remotelogs sourcetype=remote_access_logs source="C:\logs\remote_access.log"

Use source filtering when you need to distinguish this file from other inputs that use the same index or sourcetype.

Forwarding Validation Checklist

Troubleshoot Missing or Misclassified Events

No events appear in the target index

• Restart or reload the forwarder after editing inputs.conf.
• Verify that the monitor stanza is not disabled.
• Check the spelling and capitalization of the file path and confirm that the file exists.
• Confirm that the forwarder service account can read the file and traverse its parent directories.
• Confirm that new lines are being written to the file.
• Verify that forwarder-to-indexer output connectivity is configured and available.
• Check that the remotelogs index exists and that incoming data is permitted.
• Review the forwarder's internal logs for input, permission, or connection errors.
• Review the effective input configuration to detect an override from another configuration layer.

Events have an unexpected sourcetype

• Inspect the event metadata in the search results.
• Check whether sourcetype is omitted, misspelled, or assigned a different value.
• Review the effective configuration to find a higher-precedence setting that overrides the local value.

Events appear in the wrong index

• Search broadly for the source file and inspect the index metadata on matching events.
• Confirm that index = remotelogs is spelled correctly and is active in the effective input configuration.
• Verify that the receiving environment has the index and that another receiving-side configuration is not routing the data elsewhere.

Key Takeaways

• Forwarders monitor configured inputs on source hosts and send collected data to indexers.
• inputs.conf defines monitored files and is stored locally under $SPLUNK_HOME\etc\system\local\ on Windows.
• A monitor stanza identifies the file, while disabled, sourcetype, and index control collection and metadata.
• The monitored file must exist, receive data, and be readable by the forwarder service account.
• Reload or restart the forwarder after configuration changes, then verify arrival with an index- and sourcetype-filtered search.

For the complete workflow, review monitoring and forwarding logs with Splunk forwarders.