topic Re: Windows Monitoring Stanza help in Getting Data In

Windows Monitoring Stanza help

vrmandadi — Thu, 20 Jun 2019 15:45:09 GMT

I am trying to monitor the path:

\\host1\X$\Monitoring\Splunk\

Below is the stanza for it.
Am I doing anything wrong or do I need to add another "\" before the host

[monitor:\\host1\X$\Monitoring\Splunk\]

VatsalJagani — Thu, 20 Jun 2019 16:33:05 GMT

Hello @vrmandadi - I think you need to provide the complete (absolute) path to your directory. Like: C:\Users...\host1...

alonsocaio — Fri, 21 Jun 2019 18:01:26 GMT

When I monitor windows dirs I use "monitor://" + Path. Have you tried something like this into you syntax?

[monitor://C:\Windows\Logs]

jdhunter — Fri, 27 Sep 2019 21:00:06 GMT

Is Splunk running as a Domain Account and have access to read the directory? If not, It will not be able to read any network drives, shares, etc.