topic Re: Input stanza path is not absolute. in Getting Data In

Input stanza path is not absolute.

archspangler — Thu, 16 Jul 2015 14:54:59 GMT

How do I wildcard any windows drive letter in the inputs.conf stanza below?

inputs.conf

[monitor://[A-Z]:\Data\Disk1\*\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog

Causes the below error...

07-16-2015 10:53:57.601 -0400 WARN  TailingProcessor - Input stanza path, '[A-Z]:\\Data\\Disk1\\*\\MSSQL\\Log\\ERRORLOG*' is not absolute.  This is a configuration error and may not work / break things.  Change this path to an absolute path.

Re: Input stanza path is not absolute.

emiller42 — Mon, 20 Jul 2015 22:50:40 GMT

So this gets into how Splunk actually identifies what it needs to monitor. Take a more traditional monitor stanza like:

[monitor://C:\Data\Disk1\*\MSSQL\Log\ERRORLOG*]

When splunk sees the above, it goes to the deepest full path given C:\Data\Disk1\ and turns the rest of the stanza name into a regex-based whitelist which is checked against all children of the given path.

When your monitor stanza starts with a wildcard, it has no base path to enumerate in the first place. (Windows doesn't have an equivalent to /) Even if it did, this is a bad idea as Splunk will need to enumerate every single file on a system to see if it is a regex match of the desired path.

Re: Input stanza path is not absolute.

martin_mueller — Mon, 20 Jul 2015 23:13:13 GMT

To add an actual solution, just put up to 26 stanzas in your inputs.conf.

Re: Input stanza path is not absolute.

emiller42 — Tue, 21 Jul 2015 14:24:00 GMT

Yes, apologies I thought this was implied in my answer.

Re: Input stanza path is not absolute.

martin_mueller — Tue, 21 Jul 2015 14:44:38 GMT

It was, no worries.