topic Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server? in Deployment Architecture

Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server?

woodlandrelic — Fri, 23 Sep 2022 15:45:45 GMT

I am trying to monitor logs on a server. I have a UF in it and am trying to ./splunk add monitor.

When I put the path, index and so on. I keep getting this error " PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY" I have gone thru tons of questions on here but no one answer this particular question.

Thanks for your help.

Re: Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server?

richgalloway — Fri, 23 Sep 2022 18:08:01 GMT

Please tell us the exact CLI command you are using to add the monitor. What platform is the UF on? It may be necessary to put the file path in quotes.

Re: Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server?

woodlandrelic — Fri, 23 Sep 2022 19:35:02 GMT

Hi @richgalloway

The application is Linux. The app is StoneBranch

The commands from opt/splunkforwarder/bin

./splunk add monitor

Re: Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server?

isoutamo — Fri, 23 Sep 2022 20:33:58 GMT

When you are adding a monitor you must add also path to file or to directory as a parameter to the splunk add monitor command. You should do like this

./splunk add monitor /opt/foo/bar/var/log/file.log

r. Ismo

Re: Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server?

richgalloway — Fri, 23 Sep 2022 20:43:57 GMT

The add monitor command takes at least one argument so specifying just "splunk add monitor" is going to fail. See splunk help add monitor

splunk add monitor -source /var/log -index os -sourcetype foo

Re: Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server?

woodlandrelic — Fri, 23 Sep 2022 21:15:32 GMT

Hi @richgalloway

So, what I did was as I went into

/opt/splunkforwarder/etc/apps/search/Splunk_TA/local

Then vi inputs.conf

Created the monitor stanza saved and restart.

Voila and my data is popping .

Thank you guys. Am finding way around splunk.

Re: Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server?

proft — Thu, 17 Nov 2022 17:05:36 GMT

That is understood, but the Splunk Universal Forwarder 'splunk' utility is buggy and sometimes will not accept even a fully-qualified filename path. Today we deployed identical rules for identical files across 100 servers, and about 20 of them failed with this error for no apparent reason.