topic Re: Simple example of inputs.conf to monitor a logfile on a remote share in Getting Data In

Simple example of inputs.conf to monitor a logfile on a remote share

skaboy71 — Fri, 16 Sep 2011 17:29:16 GMT

I'v been looking for this but not finding it.

I have this:

[monitor://\\CAD1100092\\shared$\testing.log]
disabled = false 
followTail = 0 
host = CAD1100092

I'm running splunk as a user which has access to this UNC path:

\\cad1100092\\shared$\\testing.log

I want splunk to index it, and I want do this through the inputs.conf file.

I'm using the one in $splunkhome\ect\system\local .

Is this the correct way? Is my syntax correct?

Thanks
Aaron

Re: Simple example of inputs.conf to monitor a logfile on a remote share

skaboy71 — Fri, 16 Sep 2011 17:44:17 GMT

OK changed it to

[monitor://\\CAD1100092\shared$\testing.log]

disabled = false

host = CAD1100092

Its still not indexing

Re: Simple example of inputs.conf to monitor a logfile on a remote share

kdenton — Mon, 28 Sep 2020 09:53:20 GMT

It seems like in your examples of your inputs.conf file you only have one '\' and you are trying to index a remote log file via UNC. You need two '\'

[monitor://****CAD1100092\shared$\testing.log] <---- add a second '\' as its a UNC
disabled = false
host = CAD1100092
Its still not indexing

Re: Simple example of inputs.conf to monitor a logfile on a remote share

skaboy71 — Fri, 16 Sep 2011 18:29:54 GMT

sorry ... I have 2 ... the forum software removed one of them ... I'll adjust,

Re: Simple example of inputs.conf to monitor a logfile on a remote share

mikelanghorst — Fri, 16 Sep 2011 18:50:36 GMT

What user is the Splunkd process running as? If it's running as Local System, it won't have access to the remote share.

Re: Simple example of inputs.conf to monitor a logfile on a remote share

skaboy71 — Fri, 16 Sep 2011 20:01:37 GMT

I understand that issue. I'm running splunk as a domain user that has access to this location. I already have remote file monitors working which I configured via the gui. I am attempting to learn how to use the inputs.conf instead.

Re: Simple example of inputs.conf to monitor a logfile on a remote share

gkanapathy — Sat, 17 Sep 2011 00:01:10 GMT

Ah, I suspect it might be a problem with the $ in the path. If you can get it working in the GUI, take a look at the generated inputs.conf file (should be in $SPLUNK_HOME/etc/apps/search/local, or a correspondin place depending on the app you were in when you created it). Another way to debug will be to look at http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ and query the file monitor to see what it thinks it's doing.

Re: Simple example of inputs.conf to monitor a logfile on a remote share

gkanapathy — Sat, 17 Sep 2011 00:02:58 GMT

I edited your orignal question to fix it.

Re: Simple example of inputs.conf to monitor a logfile on a remote share

meenuvn — Tue, 07 Jun 2016 14:42:56 GMT

This discussion greatly helped me with forwarding remote logs. Thanks guys.