topic Re: Monitoring a remote server directory from my workstation in Getting Data In

Monitoring a remote server directory from my workstation

Ant1D — Wed, 25 Aug 2010 16:39:08 GMT

Hey,

I am new to Splunk and I have a newbie question 🙂

I have installed Splunk (v.4.1.3) on my workstation choosing the Local System User option. My Splunk instance is able to monitor files stored on my local drives (e.g. C:).

I have read access to log files stored on a remote server but my question is: How can I get my instance of Splunk on my local workstation to monitor the directory on the remote server containing these log files? (My instance of Splunk should be able to index these log files.)

Both the remote server and my workstation have Windows OS. Splunk is not installed on the remote server.

Thanks in advance for your help. Regards, Antoine.

Re: Monitoring a remote server directory from my workstation

simuvid — Wed, 25 Aug 2010 17:45:10 GMT

Hi there,

you can specify a shared directory containing the remote logfiles. The Splunk server must be able to read from this directory.

Re: Monitoring a remote server directory from my workstation

Ant1D — Wed, 25 Aug 2010 23:45:54 GMT

In the link you gave, it says the following:

Specify the Full path to the file or directory.

To monitor a shared network drive, enter the following: (or \<mypath> on Windows). Make sure Splunk has read access to the mounted drive, as well as to the files you wish to monitor.

How do I ensure that Splunk has read access to this?

Re: Monitoring a remote server directory from my workstation

simuvid — Thu, 26 Aug 2010 16:46:20 GMT

When you share the directory or mount the drive you have to make sure, that if you are running the Splunk Indexer with a special role, that this role can access the remote drives.
Just login to the system that hosts the Splunk Indexer and try to access the remote drive.
If that works Splunk cann also access the drive.

Cheers,

Christian

Re: Monitoring a remote server directory from my workstation

Ant1D — Thu, 26 Aug 2010 21:14:42 GMT

I can access the directory of the server from the workstation that Splunk is installed on. What do you mean exactly when you say "running the Splunk Indexer with a SPECIAL ROLE"?

Re: Monitoring a remote server directory from my workstation

Ant1D — Thu, 26 Aug 2010 22:54:22 GMT

I have managed to get it working now. Thanks for your help

Re: Monitoring a remote server directory from my workstation

tomthi — Fri, 17 Dec 2010 23:31:39 GMT

When I try to run the Indexer service under a different account, the service crashes. I can only run this service under the Local System account. I've tried this on two different machines with the same results.

Re: Monitoring a remote server directory from my workstation

shankarcv — Sat, 09 Apr 2011 01:22:45 GMT

hello daniel . can you please share with me how you managed to get it working? I am also trying to access logs on a remote UNIX server but even if I provide the UNC path Splunk is not retrieving the log files on that server.

Re: Monitoring a remote server directory from my workstation

harishnpandey — Thu, 19 Apr 2018 19:02:30 GMT

Hi Ant1D

Can you please help me to figure out how can we monitor remote log directroy from my local splunk

For e.g. below directory I have shared to everyone but unable to splunk it using FIles & Directories option

\10.172.139.32\d$\splunk

Re: Monitoring a remote server directory from my workstation

harishnpandey — Thu, 19 Apr 2018 19:02:59 GMT

Can you please help me to figure out how can we monitor remote log directroy from my local splunk

For e.g. below directory I have shared to everyone but unable to splunk it using FIles & Directories option

\10.172.139.32\d$\splunk

Re: Monitoring a remote server directory from my workstation

harishnpandey — Thu, 19 Apr 2018 20:15:15 GMT

I am getting below error:

04-19-2018 16:11:05.510 -0400 INFO TailingProcessor - Parsing configuration stanza: monitor:///10.172.139.32/d$/splunk.
04-19-2018 16:11:05.510 -0400 INFO TailingProcessor - Adding watch on path: \10.172.139.32/d$/splunk.
04-19-2018 16:11:07.889 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: no drive specifier found: '10.172.139.32/d$/splunk'
04-19-2018 16:12:07.713 -0400 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-MonitorNoHandle.exe"" splunk-monitornohandle - configure: no drive specifier found: '10.172.139.32/d$/splunk'

Re: Monitoring a remote server directory from my workstation

harishnpandey — Thu, 19 Apr 2018 20:19:24 GMT

I have configured below parameters to monitor remote path under "c$\Program Files\Splunk\etc\system\default\inputs.conf" as

[monitor:///10.172.139.32/d$/splunk]
index=lm-uscmit-p-finsvcs

[MonitorNoHandle://10.172.139.32/d$/splunk]
index=lm-uscmit-p-finsvcs

However, I am getting below error after restarting Splunk as: