Documentation: 3.2.3
|  Print Version Contents
This page last updated: 04/02/08 02:04pm

Determine what files Splunk is tailing

When you configure inputs, you may want to know what specific files Splunk will read prior to starting Splunk for indexing. This is especially true when configuring whitelisting/blacklisting rules. Splunk includes a listtails utility which reads in the configuration of inputs.conf in all bundles, scans your directories and shows you the exact list of files what Splunk will tail when you restart. This allows you to make changes to inputs.conf and verify if the blacklist/whitelist filtering is correct.

Run listtails

To use the listtails utility:
1. Navigate to $SPLUNK_HOME/bin/.
2. Run the command ./splunk cmd listtails.

Previous: Strip syslog headers before processing    |    Next: Index SNMP events with Splunk

Comments

No comments have been submitted.

Log in to comment.