Determine what files Splunk will be tailing
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Determine what files Splunk will be tailing
When configuring your inputs there often is a need to know what specific files Splunk will reading prior to starting Splunk for indexing. This is especially true when configuring Whitelisting/Blacklisting rules. Splunk ships the listtails utility which reads in the configuration of inputs.conf in all bundles, scans your directories and shows you the exact list of files that Splunk will tail when you restart. This allows you to make changes to inputs.conf and verify if the blacklist/whitelist filtering is correct.
Running listtails
In order to use the listtails utility perform the following steps:
- Navigate to your
$SPLUNK_HOME/bin/directory - Run the command
source setSplunkEnv - Run the command
listtails
This documentation applies to the following versions of Splunk: 3.1.3 , 3.1.4 View the Article History for its revisions.