topic Re: Successfully recurse sub-directories in Windows? in Getting Data In

Successfully recurse sub-directories in Windows?

loatswil — Tue, 06 Jun 2017 17:48:08 GMT

I can't find the correct way to recursively monitor sub-directories in Windows for all files ending in .log.

Can someone please enlighten me with the proper inputs.conf stanza?

Thanks,

Re: Successfully recurse sub-directories in Windows?

adonio — Tue, 06 Jun 2017 17:55:51 GMT

i think you mean to this:
example: monitor everything in C:\file\mylogs drive and look for .log extension files

[monitor://C:\file\mylogs\*.log]

all examples here:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Specifyinputpathswithwildcards

Re: Successfully recurse sub-directories in Windows?

loatswil — Tue, 06 Jun 2017 18:12:42 GMT

That works for c:\file\mylogs\file.log but not for c:\file\mylogs\morelogs\evenmorelogs\file.log

I understand that recursive=true is the default but it doesn't appear to work in this case.

I've tried...

[monitor://c:\file\mylogs\...\*.log]

with no luck either.

I've tried...

[monitor://c:\file\mylogs\...\]
whitelist=(\.log$)

also with no luck.

Re: Successfully recurse sub-directories in Windows?

loatswil — Tue, 06 Jun 2017 18:38:11 GMT

Also, I see some documentation using:

recursive=true

and some showing...

recurse=true

I realize that is also the default but which is correct if hardsetting the option?

Re: Successfully recurse sub-directories in Windows?

adonio — Wed, 07 Jun 2017 13:06:22 GMT

hello there,
so i tested and created a file in: C:\Users\adonio\Desktop\ari1\ari2\ari3\ari.log
my input.conf is:

[monitor://C:\Users\adonio\Desktop\ari1\...\]
index = test_ari
sourcetype = test_ari

it captures the data
tried as well with:

[monitor://C:\Users\adonio\Desktop\ari1\...\*.log]
index = test_ari
sourcetype = test_ari

works just fine
please verify your full path to file.
hope it helps

Re: Successfully recurse sub-directories in Windows?

loatswil — Wed, 07 Jun 2017 15:53:42 GMT

Thanks, I've tried this as well without success. Do you know if spaces in the path might be a problem? I am looking in the "Program Files" directory and that is the only difference I see.

Also, can you tell me what version of Forwarder you are using as well as your Splunk installation version please?

There must be something wonky with my install.

Thanks, I appreciate it. A LOT.

Re: Successfully recurse sub-directories in Windows?

adonio — Wed, 07 Jun 2017 16:11:14 GMT

i am putting a new answer so i can attach screenshot
it works well with Program Files as well

Re: Successfully recurse sub-directories in Windows?

adonio — Wed, 07 Jun 2017 16:14:53 GMT

here is the regular path and path under Program Files:

C:\Program Files\ari1\ari2\ari3\another_test.log
C:\Users\adonio\Desktop\ari1\ari2\ari3\ari.log

here are inputs:

[monitor://C:\Users\adonio\Desktop\ari1\...\]
index = test_ari
sourcetype = test_ari

[monitor://C:\Program Files\ari1\...\]
index = test_ari
sourcetype = another_test_ari

here is a screenshot:

Re: Successfully recurse sub-directories in Windows?

loatswil — Wed, 07 Jun 2017 16:29:55 GMT

Thanks for the confirmation. I am using the same input so this makes me believe there is something else wrong with my install.

Re: Successfully recurse sub-directories in Windows?

adonio — Wed, 07 Jun 2017 16:32:17 GMT

can you share your full path to file and your inputs.conf?

Re: Successfully recurse sub-directories in Windows?

loatswil — Wed, 07 Jun 2017 16:38:41 GMT

Here is my inputs.conf...

[monitor://C:\Program Files\PaperCut NG\...\*.log]
index = infotech
sourcetype = papercut
disabled = 0

And there are multiple log files under multiple subdirectories that aren't being indexed.

Re: Successfully recurse sub-directories in Windows?

adonio — Wed, 07 Jun 2017 16:48:41 GMT

i suspect that there is something in the "PaperCut NG" directory name
try to go to explorer all the way to file path, right click on the path and copy it to notepad++
verify the space between PaperCut and NG is really a space.
copy the exact path from notepad++ to your inputs.conf
replace the sub-directories with ...\

Re: Successfully recurse sub-directories in Windows?

loatswil — Wed, 07 Jun 2017 20:18:42 GMT

The inputs.conf is pushed from our deployment server so it was created using vim and doubtfully has any weird spaces.

I have edited the file locally and made sure there are no strange spaces or characters. It looks as though it sees the files but just does not index them. I can echo information to the files and I get no results when doing an All Time (Real Time) search on the file.