topic Re: Windows log file data is not coming in Getting Data In

Windows log file data is not coming

sekhar463 — Fri, 19 Jan 2024 09:56:06 GMT

hai

i have configured below log file stanza but not getting data into splunk from windows UF

having latest on Jan 4th but those data also not came
is any parameter need to add ?

below is the config file

[monitorNoHandle://C:\Program Files\Crestron\CCS400\User\Logs\CCSFirmwareUpdate.txt]
index=Testindx
sourcetype=test_sourcetype
disabled=0

Re: Windows log file data is not coming

gcusello — Fri, 19 Jan 2024 10:03:33 GMT

Hi @sekhar463,

I suppose that you already configured outputs.conf and that you're already reeving logs from that machine.

Please try this:

[monitor://C:\Program Files\Crestron\CCS400\User\Logs\CCSFirmwareUpdate.txt] index=Testindx sourcetype=test_sourcetype disabled=0

Ciao.

Giuseppe

Re: Windows log file data is not coming

PickleRick — Fri, 19 Jan 2024 10:17:44 GMT

1. Do you get _any_ data from this forwarder? Especially events into _internal index.

2. Do you see any errors in c:\program files\splunk (or SplunkUniversalForwarder, depending on version)\var\log\splunk\splunkd.log on the forwarder?

3. What is the output of

splunk list monitor

and

splunk list inputstatus

run on your UF?

Re: Windows log file data is not coming

sekhar463 — Fri, 19 Jan 2024 14:07:37 GMT

still not coming

the file is text file as below and its under Program Files\Crestron\CCS400\User\Logs\

and want to ingest the file CCSFirmwareUpdate.txt

Re: Windows log file data is not coming

gcusello — Fri, 19 Jan 2024 14:11:04 GMT

Hi @sekhar463 ,

which user are you using to run Splunk, has this user the grants to read this file?

please check that the path of the file is correct, runing the dir command in a cmd window.

Ciao.

Giuseppe

Re: Windows log file data is not coming

dural_yyz — Fri, 19 Jan 2024 18:23:12 GMT

https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Inputsconf

[MonitorNoHandle://<path>]

* This input intercepts file writes to the specific file.

It appears this monitor config does not read the file itself but only intercepts what is about to be written to the file. Your image shows last modified as Jan 4th which is your stated last ingest.

I think your configuration will only capture future content and not existing content.