https://community.splunk.com/t5/Getting-Data-In/Monitor-problem/m-p/11263#M541 <P>Windows Local System accounts can't access network shares. You will have to reconfigure Splunk to run as a network user who has access to the remote server. The easiest way to do this is to run the installer over again.</P> Tue, 13 Apr 2010 03:19:13 GMT gkanapathy 2010-04-13T03:19:13Z https://community.splunk.com/t5/Getting-Data-In/Monitor-problem/m-p/11262#M540 <P>I just installed Splunk 4.1 (configured to run on system accounts) and the first thing i did was add an input monitor of the file/directory type. i used a UNC path over the admin share to get to IIS logs on a remote server. \server\c$\windows\system32\logfiles\w3svc1 set the host to constant value, gave it a host value, left the sourcetype as automatic and put it in the Main indexer. after configuring this the "local system" part clicked and i made the domain computer account an admin on the remote system (just to get this going to get a feel for it) and let it sit for a bit. Its been sitting for a while now and in the data inputs the 'number of files' is blank and the indexer for main is still empty. what am i missing and how do i diagnose it? Thanks</P> Tue, 13 Apr 2010 01:38:04 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-problem/m-p/11262#M540 jrich523 2010-04-13T01:38:04Z https://community.splunk.com/t5/Getting-Data-In/Monitor-problem/m-p/11263#M541 <P>Windows Local System accounts can't access network shares. You will have to reconfigure Splunk to run as a network user who has access to the remote server. The easiest way to do this is to run the installer over again.</P> Tue, 13 Apr 2010 03:19:13 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-problem/m-p/11263#M541 gkanapathy 2010-04-13T03:19:13Z