topic Re: Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"? in Getting Data In

Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

danielearangiom — Fri, 21 Sep 2018 12:57:57 GMT

My Splunk Universal Forwarder is not able to read the modification on a file under the path "C:\Program Files (x86)"

My inputs.conf is:

[monitor://C:\Program Files (x86)\TeamViewer\TeamViewer13_Logfile.log]
sourcetype = TeamViewer:Connection:Client
index = teamviewer
disabled = 0
queue = indexQueue

What am I doing wrong? I cannot see anything about this file in splunkd.log.

Re: Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

richgalloway — Fri, 21 Sep 2018 14:29:43 GMT

Does the forwarder have read access to the file?

Re: Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

danielearangiom — Fri, 21 Sep 2018 14:33:33 GMT

The file is setted r/w for everyone

Re: Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

amiftah — Fri, 21 Sep 2018 20:34:11 GMT

"Cannot read modification" does it mean that the file has been indexed, just the modification that you can't see on splunk?

Re: Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

danielearangiom — Mon, 24 Sep 2018 08:23:09 GMT

The destination index is still empty

Re: Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

amiftah — Mon, 24 Sep 2018 13:46:39 GMT

As @richgalloway mentioned, do you have read access to this file, check the permissions by executing ls -ll
Are the splunkd services running?
Did you create the teamviewer index in the indexer?
if you added that monitoring stanza manually in the inputs.conf, did you restart your universal forwarder after that?
Does your sourcetype exist in the indexer?
Retry without the queue = indexQueue?

Re: Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

danielearangiom — Thu, 27 Sep 2018 12:32:07 GMT

I was missing props.conf, it is mandatory even if it is empty

Re: Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

richgalloway — Thu, 27 Sep 2018 13:30:36 GMT

@danielearangiomazza If your problem is resolved, please accept the answer to help future readers.