topic Re: Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux? in Getting Data In

Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux?

mmohiuddin — Tue, 21 Apr 2015 19:40:45 GMT

I am unable to enable monitoring on a network file share, \servername\f$\XXX\XXX on a linux server. I am adding the path as data inputs from the GUI. I had made sure that the Splunkd is running as root on the linux splunk search head server. I am getting the following error:

Parameter name: Path must be absolute.

I was able to test the same thing out on my Windows Search Head on version 6.1.4 version and splunkd started monitoring files from the network file share \servername\f$\XXX\XXX, but when I am trying to replicate the same thing on linux Splunk Search Head server, I get the parameter name : path must be absolute error.

Please guide me if I am missing something.

Re: Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux?

tlagatta_splunk — Wed, 29 Apr 2015 13:51:22 GMT

@mmohiuddin, I encountered this same error last night when uploading some data. This morning, I tried uploading the data on a different network, and it worked without any problem. Were you able to resolve your issue?

Re: Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux?

sloshburch — Tue, 23 Jun 2015 13:21:27 GMT

Seeing the same thang while uploading csv from my local desktop. Interesting...

Re: Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux?

sloshburch — Tue, 23 Jun 2015 13:23:01 GMT

Worked when I selected the file (rather than drag and drop into UI).

Re: Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux?

MuS — Fri, 26 Jun 2015 01:46:06 GMT

Hi mmohiuddin,

can you provide the complete monitor stanza?
Usually this kind of error pops up if you try to monitor a windows path from linux like this:

[monitor://c:\foo\bar\file.txt]

Or on a windows server something like this:

[monitor:///foo/bar/file.txt]

Re: Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux?

gbronner_rbc — Thu, 24 Sep 2015 20:06:00 GMT

Happened to me as well. Went back and tried uploading it again using the saved format I'd created early, and did not get the error. Wondered if something happened on the filesystem, as the file was on a UNC path.

Re: Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux?

napomokoetle — Fri, 13 Nov 2015 12:48:55 GMT

Was getting the "ERROR AdminManager - Parameter name: Path must be absolute" problem when I tried upLoad File into Splunk. After a couple of attempt without success on Firefox web browser, I decided to try Chrome browser and the data file was uploaded successfully!!!

I hope that saves someone some grief!

Re: Why am I getting error "Parameter name: Path must be absolute" trying to enable network file share monitoring using Splunk 6.2.2 installed on Linux?

jkat54 — Thu, 31 Dec 2015 10:23:23 GMT

The syntax for monitoring a network share is different between windows and linux:

from http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/MonitorfilesanddirectorieswithSplunkWeb#Select_the_input_source :

To monitor a shared network drive, enter the following: <myhost>/<mypath> (or \\<myhost>\<mypath> on Windows). Make sure Splunk has read access to the mounted drive, as well as to the files you wish to monitor.

You may also prefer to "mount" the network drive on the linux box before monitoring it so that it will be on a local path like /mnt/networkShare

Finally, make sure the user splunkd is running as has permission on the network share.

https://answers.splunk.com/answers/6020/monitoring-a-remote-server-directory-from-my-workstation.html