topic Re: monitor stanza in Windows in Getting Data In

monitor stanza in Windows

mcbradford — Thu, 31 Oct 2013 21:04:31 GMT

I want to monitor the following

C:\Users\...\AppData\Local\Microsoft\Windows\Burn

sometimes with the Burn directory there will be other folders.

I want to monitor all the folders and files under the burn directory

The following does not appear to be working:

[monitor://C:\Users\...\AppData\Local\Microsoft\Windows\burn\]
sourcetype = WindowsBurnLog
disabled = 0
index=windows

Re: monitor stanza in Windows

Ayn — Thu, 31 Oct 2013 21:11:43 GMT

Check splunkd.log to see what Splunk says about this input.

Re: monitor stanza in Windows

mcbradford — Thu, 31 Oct 2013 21:15:20 GMT

Nothing really. I even added a "*"

tailingProcessor - Parsing configuration stanza: monitor://C:\Users...\AppData\Local\Microsoft\Windows\burn*

Re: monitor stanza in Windows

rtadams89 — Mon, 02 Jun 2014 17:39:09 GMT

Try adding "recursive = true" to the stanza. This should be the default, but worth a shot just in case.

Also, what exactly is not working? Do you only get files directly in the "burn" directory indexed? Do you get them from all users folders or just some?

You may also want to try using:
monitor://C:\Users...\AppData\Local\Microsoft\Windows\burn...*