https://community.splunk.com/t5/Getting-Data-In/Text-File-Ingestion/m-p/693628#M115299 <P>I want Splunk to ingest my AV log. I made the following entry in the inputs.conf file:<BR />Note: The log file is a text file with no formatting.</P> <P>[monitor://C:ProgramData\'Endpoint Security'\logs\OnDemandScan_Activity.log]</P> <LI-CODE lang="markup">disable=0 index=winlogs sourcetype=WinEventLog:AntiVirus start_from=0 current_only=0 checkpointInterval = 5 renderXml=false</LI-CODE> <P>&nbsp;</P> <P>My question is:</P> <P>Is the stanza written correctly?</P> <P>When I do a search I am not seeing anything.</P> Wed, 17 Jul 2024 17:33:20 GMT sswigart 2024-07-17T17:33:20Z https://community.splunk.com/t5/Getting-Data-In/Text-File-Ingestion/m-p/693628#M115299 <P>I want Splunk to ingest my AV log. I made the following entry in the inputs.conf file:<BR />Note: The log file is a text file with no formatting.</P> <P>[monitor://C:ProgramData\'Endpoint Security'\logs\OnDemandScan_Activity.log]</P> <LI-CODE lang="markup">disable=0 index=winlogs sourcetype=WinEventLog:AntiVirus start_from=0 current_only=0 checkpointInterval = 5 renderXml=false</LI-CODE> <P>&nbsp;</P> <P>My question is:</P> <P>Is the stanza written correctly?</P> <P>When I do a search I am not seeing anything.</P> Wed, 17 Jul 2024 17:33:20 GMT https://community.splunk.com/t5/Getting-Data-In/Text-File-Ingestion/m-p/693628#M115299 sswigart 2024-07-17T17:33:20Z https://community.splunk.com/t5/Getting-Data-In/Text-File-Ingestion/m-p/693630#M115300 <P>Try removing the quotes from the file path.</P><P>Check splunkd.log for errors relating to that input.</P> Wed, 17 Jul 2024 17:05:29 GMT https://community.splunk.com/t5/Getting-Data-In/Text-File-Ingestion/m-p/693630#M115300 richgalloway 2024-07-17T17:05:29Z