topic Re: Directory Names in Getting Data In

Directory Names

dzilk — Tue, 24 Jan 2012 21:49:27 GMT

I am new to splunk and am trying to set up a monitored directory. It appears that when browsing for an existing directory to use, splunk does not recognize directories named with a leading underscore character. Has anyone else observed this? I am running splunk on Windows 7.

Re: Directory Names

MHibbin — Wed, 25 Jan 2012 14:02:22 GMT

dzilk,

I assume you are using the GUI to build your monitored inputs, I would recommend setting your inputs up, using the inputs.conf file. The reason being that you have a lot more control over what Splunk does, when you modify the conf files.

To get you started you can find a "monitor" stanza, which has already been set up, in you inputs.conf and replicate it for your needs.

The following documentation should help with the setup of your inputs.conf (http://docs.splunk.com/Documentation/Splunk/4.3/admin/Inputsconf)

The following documentation shows gives some direction on setting up a monitor stanza in your inputs.conf (http://docs.splunk.com/Documentation/Splunk/latest/Data/Editinputs.conf)

Regards,

Matt

Re: Directory Names

dzilk — Wed, 25 Jan 2012 16:30:34 GMT

Thanks for the answer. I was really more concerned that some directories on my server were not visible and select-able from the GUI. Is this a bug? This was specifically noted on the "Preview Data before Indexing" screen when choosing a file or directory to index. If 'Browse Server' is selected, some folders are not displayed, specifically those whose names begin with an underscore.