topic Re: To monitor a Folder in Windows Server ? in Getting Data In

To monitor a Folder in Windows Server ?

chimbudp — Mon, 28 Sep 2020 13:20:48 GMT

I need to monitor the Assembly folder in Windows Server :
[monitor://C:\Windows\assembly]
index=Assembly_monitor

the above stanza forwards no data into Splunk indexer.

i have set the source type as assembly and modified as below inputs.conf:

[monitor://C:\Windows\assembly]
index=Assembly_monitor
sourcetype=Assembly

& also edited props.conf as :

[Assembly]
NO_BINARY_CHECK = true

-- Even also i am not getting any data 😞
Please help

Ayn — Tue, 19 Feb 2013 13:50:09 GMT

Do you see other data from this forwarder in your indexer?
Have you checked splunkd.log on the forwarder?
Did you have a look at the status of file inputs (http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/)?
Most of all, why would you want to index the binary data in the assembly directory? What are you trying to achieve?

arvidn — Tue, 19 Feb 2013 13:58:36 GMT

Hi, I think you are missing "\" before Windowsassembly

[monitor://C:\Windowsassembly]

arvidn — Tue, 19 Feb 2013 14:03:34 GMT

Should be "backslash" in front of Windowsassembly. But not shown in my answere, probably missing in question too?

chimbudp — Tue, 19 Feb 2013 15:42:34 GMT

Yes. it was not displayed in question & ur answer too.
But i am using backslash wherever it required