https://community.splunk.com/t5/Getting-Data-In/fschange-with/m-p/125983#M25963 <P>I changed the syntax to:</P> <P>[fschange:C:\Users...\AppData\Local\Microsoft\Windows\Burn]</P> <P>and it is still not working.</P> <P>Can you use ...\? There are lots of users, so we would not be able to specify a different path for each user.</P> Fri, 01 Nov 2013 17:13:09 GMT mcbradford 2013-11-01T17:13:09Z https://community.splunk.com/t5/Getting-Data-In/fschange-with/m-p/125981#M25961 <P>This is my inputs.conf</P> <P>[fschange://C:\Users...\AppData\Local\Microsoft\Windows\Burn]<BR /> index=windows<BR /> recurse=true<BR /> sourcetype=opticalmediaburn<BR /> pollPeriod=60<BR /> followLinks=true<BR /> fullEvent=true<BR /> delayInMills=1000</P> <P>I see this in my _internal log</P> <P>FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time - //C:\Users...\AppData\Local\Microsoft\Windows\Burn</P> <P>What am I doing wrong. The file/path does exist</P> Fri, 01 Nov 2013 15:23:05 GMT https://community.splunk.com/t5/Getting-Data-In/fschange-with/m-p/125981#M25961 mcbradford 2013-11-01T15:23:05Z https://community.splunk.com/t5/Getting-Data-In/fschange-with/m-p/125982#M25962 <P>You should be using [fschange:<PATH>] not [fschange://<PATH>]</PATH></PATH></P> <P>Something like this:<BR /> [fschange:C:\Users\AppData\Local\Microsoft\Windows\Burn]</P> Fri, 01 Nov 2013 17:03:39 GMT https://community.splunk.com/t5/Getting-Data-In/fschange-with/m-p/125982#M25962 dmaislin_splunk 2013-11-01T17:03:39Z https://community.splunk.com/t5/Getting-Data-In/fschange-with/m-p/125983#M25963 <P>I changed the syntax to:</P> <P>[fschange:C:\Users...\AppData\Local\Microsoft\Windows\Burn]</P> <P>and it is still not working.</P> <P>Can you use ...\? There are lots of users, so we would not be able to specify a different path for each user.</P> Fri, 01 Nov 2013 17:13:09 GMT https://community.splunk.com/t5/Getting-Data-In/fschange-with/m-p/125983#M25963 mcbradford 2013-11-01T17:13:09Z