Splunk online course

Configure Splunk Forwarders to Monitor and Send Log Files

Learn how to configure a Splunk Universal Forwarder on Windows to monitor a log file, assign a sourcetype and index, forward events, restart the service, and verify ingestion.

A Splunk forwarder collects data on a host and transmits it to a Splunk indexer. The forwarder performs collection, while the indexer receives, processes, stores, and makes events searchable. A search head or Splunk Web is then used to search the indexed data.

This lesson configures a Windows Universal Forwarder to monitor C:\logs\remote_access.log, label the events with the remote_access_logs sourcetype, and send them to the remotelogs index.

Understand the Forwarding Data Flow

The source host contains the log file. The Universal Forwarder reads new content, turns that content into events, and sends the events over its configured output connection. The indexer receives the events, assigns or preserves metadata, stores them in an index, and makes them available to searches.

• Forwarder: Collects data from the source host and transmits it.
• Indexer: Receives, processes, stores, and indexes events.
• Search interface: Runs searches against the indexed data.

A forwarder is not a replacement for an indexer. It generally does not provide the primary storage and search function used for the collected events.

Edit inputs.conf on Windows

inputs.conf is the Splunk configuration file used to define data inputs, including files and directories to monitor. For administrator-created settings on a Windows forwarder, use the local configuration directory:

%SPLUNK_HOME%\etc\system\local\inputs.conf

SPLUNK_HOME means the root installation directory of the Splunk instance. Depending on the installation choices, it may be a directory such as C:\Program Files\SplunkUniversalForwarder. Use the actual installation path on your host.

The local directory is intended for administrator-created configuration. Settings placed there can override default settings supplied by the installation or an application. Create the file if it does not already exist.

Open an editor with appropriate administrative permissions before changing the file. The account used to edit the file must be allowed to write to the Splunk installation directory. The forwarder service account must separately be able to read the monitored log and traverse every parent directory.

Understand Stanzas and Key-Value Settings

A stanza is a bracketed configuration section. It identifies the input type and target. For a file monitor, the stanza begins with monitor:// followed by the file path.

Settings inside a stanza use key=value syntax. These settings control monitoring behavior and event metadata. In this example, sourcetype labels the event category and index selects the destination data store.

Create a Monitor Input for the Log File

Add the following stanza to the forwarder's local inputs.conf:

[monitor://C:\logs\remote_access.log]
sourcetype = remote_access_logs
index = remotelogs

This configuration watches the specific file C:\logs\remote_access.log. When the application appends new content, the forwarder reads the new content and sends the resulting events to the configured receiving indexer.

The configured service account needs read permission on the file and permission to access its parent directories. If the file is protected by Windows permissions, the forwarder may run normally but still be unable to collect the file.

Assign a sourcetype

A sourcetype is metadata that identifies an event format or logical category. It helps Splunk apply appropriate parsing, field extraction, and search behavior. The custom value remote_access_logs makes these events easy to identify in searches.

Assign an index

An index is a named Splunk data store and a common search scope. The setting index = remotelogs routes the monitored events to the remotelogs index.

The target index must exist on the receiving configuration and be enabled for incoming data. The receiving indexer must also permit the forwarder to send events to it. If the index has not been created, an administrator must create it before relying on this input. See Create An Index and What Is An Index.

Apply the Configuration Change

In this workflow, restart the forwarder after changing inputs.conf. Open an elevated Command Prompt, change to the forwarder's bin directory, and run:

cd /d "%SPLUNK_HOME%\bin"
splunk restart

If SPLUNK_HOME is not defined in the command environment, replace it with the actual installation path. Follow the prompts if the forwarder requests administrator credentials.

When Splunk runs as a Windows service, you can also restart it through the Windows Services console by locating the Splunk Universal Forwarder service and choosing Restart. An administrator can use the service-management command line as an alternative, using the service name configured on that host.

Verify Ingestion from the Indexer

After restarting the forwarder and allowing time for an event to arrive, run this search from the Splunk search interface:

index=remotelogs sourcetype=remote_access_logs

Limit the time range appropriately for the test. Matching results confirm the complete basic path: the forwarder collected the file, forwarded the events, the indexer received and indexed them, and the search can find them using the assigned metadata.

If the source application has not written anything recently, append a recognizable test line to the log file. For example, add a line containing a unique value such as FORWARDER_TEST_2026, wait briefly, and search for that value:

index=remotelogs sourcetype=remote_access_logs FORWARDER_TEST_2026

Only add test content where doing so is safe and consistent with the application’s log format.

Data Flow Validation Checklist

Troubleshoot Missing or Misclassified Events

No events appear in the search

• Confirm that the monitor path exactly matches the real Windows file path.
• Check the brackets, spelling, and key-value syntax in the stanza.
• Confirm that the file has received new data since monitoring was enabled. Append a known test event if appropriate.
• Verify that the forwarder was restarted after editing inputs.conf.
• Check that the forwarder is running and has an active output connection to the indexer.
• Check that the forwarder service account can read the file and traverse its parent directories.
• Verify that the receiving indexer accepts forwarded data and that remotelogs exists.
• Check the spelling of both remotelogs and remote_access_logs.
• Search the target index without a sourcetype filter to detect a metadata mismatch: index=remotelogs.

Events arrive in an unexpected index

The index setting may be absent, misspelled, or overridden by a higher-precedence configuration. Inspect the effective input configuration, confirm the final value for the monitored path, and verify that the named index exists and is enabled. If permitted, search across available indexes to locate the events.

Events have an unexpected sourcetype

The sourcetype may be missing, overridden, or affected by another input definition that matches the same file. Review all applicable inputs.conf files and determine the final effective configuration for the monitored path. Ensure that the search uses the exact assigned spelling.

Key Terms

• Splunk forwarder: A Splunk component installed on a data-producing host that collects and sends data to another Splunk component.
• Universal Forwarder: A lightweight forwarder commonly used to send local machine data to indexers.
• Indexer: The component that receives, processes, stores, and makes event data searchable.
• Monitor input: An input definition that watches a file or directory for data.
• Event: An individual record of machine data captured and indexed by Splunk.

For related collection methods, see Add Data To Splunk, Windows Inputs, and Collect Event Logs From A Local Windows Machine.