How to pull in logs from User's Appdata

vishalduttauk — Fri, 03 Feb 2023 12:21:52 GMT

Hi there,

I am trying to ingest data which is stored within the profile of a user's AddData location:

C:\Users\(User ID)\AppData\Local\UiPath\Logs but can't pull in any events. I've tried lots of different stanzas

[monitor://C:\Users\DKX*\AppData\
[monitor://C:\Users\DKX$\AppData\
[monitor://C:\Users\...\AppData\
[monitor://C:\Users\%userprofile%\AppData\

Any idea why it isn't working? I know i've not added in all my stanza attempts but could it be due to the Splunk service account not having access to that location?

Re: How to pull in logs from User's Appdata

richgalloway — Fri, 03 Feb 2023 13:50:05 GMT

Please detail what is mean by "it isn't working". What happens when you try those monitor stanzas? What errors are reported? Does the account running Splunk have read access to the files? Why do you your monitor stanza names end with "AppData" when you want to ingest "AppData\Local\UiPath\Logs"?

topic How to pull in logs from User's Appdata in Getting Data In

How to pull in logs from User's Appdata

Re: How to pull in logs from User's Appdata