topic Monitor specific path in Windows in Getting Data In

Monitor specific path in Windows

hagjos43 — Fri, 26 Oct 2012 14:05:05 GMT

We are trying to monitor a specific .log file in Windows 2k3 and 2k8. For example:

D:\logfiles\log123.log

We opened the "D:\Program Files\Splunk\etc\system\local\inputs.conf" Then added the line:

[monitor://D:\logfiles\log123.log]

Saved the file, restarted the service and waited. No data from that path came into the splunk server. It is reporting data from the WMI Security logs, but not the path stated above. We DONT want to reinstall the forwarders on every machine every time we need to make a change (we plan to use a deployment server in the future too). I read that this is possible but can't figure out why it isn't work.

Any help would be greatly appreciated. Thank you.

Re: Monitor specific path in Windows

yannK — Fri, 26 Oct 2012 14:16:04 GMT

The inputs.conf looks correct. Please restart splunk and check the internal logs in %SPLUNK_HOME%\var\log\splunk\splunkd.log for any errors or warnings.

Splunk is case sensitive, check the path and filename
Maybe the splunk service doesn't has read permissions on the file/folder, check permissions
Maybe the file is skipped because it is considered as a duplicate (see http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/HowLogFileRotationIsHandled )

Re: Monitor specific path in Windows

hagjos43 — Fri, 26 Oct 2012 14:31:47 GMT

I looked in the var\log\splunkd.log file for errors and we are seeing this immediately under the specified path:
BatchReader = State transitioning from 2 to 0 (initOrResume).