https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137717#M28337 <P>You using the case sensitive path to your logs? Since you haven't posted the path to your own and you mention system32 I'm guessing the path is the default one. This has worked for me. </P> <PRE><CODE>[monitor://C:\WINDOWS\system32\dhcp] sourcetype = DhcpSrvLog crcSalt = &lt;SOURCE&gt; disabled = false whitelist = Dhcp.+\.log </CODE></PRE> Tue, 12 Nov 2013 01:10:22 GMT Runals 2013-11-12T01:10:22Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137713#M28333 <P>When I install the universal forwarder on my DHCP server, I want to monitor the DHCP folder under system32, but from the software, when I use "path to monitor", I cannot find the DHCP folder through Directory, can you let me know why?</P> Mon, 11 Nov 2013 23:36:31 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137713#M28333 p1004 2013-11-11T23:36:31Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137714#M28334 <P>Is Splunk setup to run as a system account or a domain account? If it is setup as a domain account, it may not have the correct permissions to that directory.</P> Mon, 11 Nov 2013 23:54:47 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137714#M28334 ShaneNewman 2013-11-11T23:54:47Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137715#M28335 <P>Thanks for your answer, I am running a domain admin account, and it is in the local admin group, the permission should not be a problem. </P> Tue, 12 Nov 2013 00:02:40 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137715#M28335 p1004 2013-11-12T00:02:40Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137716#M28336 <P>If you browse the folder directory as the domain account on the server itself, can you see the files you want to monitor?</P> Tue, 12 Nov 2013 00:13:54 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137716#M28336 ShaneNewman 2013-11-12T00:13:54Z https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137717#M28337 <P>You using the case sensitive path to your logs? Since you haven't posted the path to your own and you mention system32 I'm guessing the path is the default one. This has worked for me. </P> <PRE><CODE>[monitor://C:\WINDOWS\system32\dhcp] sourcetype = DhcpSrvLog crcSalt = &lt;SOURCE&gt; disabled = false whitelist = Dhcp.+\.log </CODE></PRE> Tue, 12 Nov 2013 01:10:22 GMT https://community.splunk.com/t5/Getting-Data-In/universal-forwarder-cannot-find-the-path-which-I-want-to-specify/m-p/137717#M28337 Runals 2013-11-12T01:10:22Z