topic Input source path case sensitive? in Getting Data In

Input source path case sensitive?

eugenekogan — Thu, 26 Jan 2012 16:13:18 GMT

Is the path specified in a monitor stanza in inputs.conf case sensitive?

For example, [monitor://C:\Windows\System32\dhcp] does not seem to work on servers that use the path of C:\WINDOWS\system32\dhcp. It's the same path except for capitalization of directory names.

If this is correct, is there a way to make it not case sensitive?

Thanks!

Re: Input source path case sensitive?

tgow — Thu, 26 Jan 2012 17:23:46 GMT

If you are having problems then I would suggest that you take advantage of wildcarding for directories which is available. Here is an example:

[monitor::C:\...dhcp]

[monitor::...System32\dhcp]

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/4.3/Data/Specifyinputpathswithwildcards

Re: Input source path case sensitive?

gbronner_rbc — Wed, 23 Sep 2015 15:33:56 GMT

The original poster asked a reasonable question, which is that while files are case-sensitive on Unix, the convention is that they are not on Windows. Hence, this behaviour, if confirmed, would be uncommon, and deserves to be highlighted.

Re: Input source path case sensitive?

jacobappleton — Wed, 03 Jul 2019 19:58:10 GMT

While I haven't been able to find anything in the documentation, in my experience, yes, Windows paths are case-sensitive.