topic Re: Monitoring directory on a remote host in Getting Data In

Monitoring directory on a remote host

madavis1986 — Tue, 17 Jul 2018 14:15:16 GMT

I am attempting to ingest data from a remote host (Linux) to my Search Head/Indexer host (Windows) via Splunk Web. I am unable to install a Splunk instance on the remote host, so a Forwarder is not a feasible solution. I have seen it suggested in other Splunk>answer threads that one can mount the filesystem of the remote server , although it is not ideal. I mounted the remote server and can successful ingest the data using the Add Data>upload option, but that same data is not visible if I attempt to use Add Data>monitor>Files&Directories for real-time ingestion. Why is the data only visible for Upload and not real-time Monitor? Would changes should I implement to enable this?

Splunk version: 7.0.3
Directory to ingest: mapped to a network drive (S:)

Re: Monitoring directory on a remote host

CarsonZa — Tue, 17 Jul 2018 16:37:42 GMT

you can still use the monitor type input, it just wont show you a preview of the data before ingesting for remote hosts. This is working as intended.

Re: Monitoring directory on a remote host

madavis1986 — Thu, 19 Jul 2018 15:32:12 GMT

My original issue was the Select a Source screen reporting the following error "This path does not exist or is not accessible" (not the preview message). I now believe that this was due to me attempting to select a file using a mapped network drive. Switching to UNC path allowed me to complete the Add Data process.

Unfortunately no events from my monitored file (/var/log/messages) are being ingested.
splunkd.log is reporting the following error: WARN FilesystemChangeWatcher - error getting attributes of "\messages: The network path was not found

If I attempted to select index once option (instead of continuously monitoring) I reach the Review step of the Add Data process where a similar error is displayed: unable to open file: path='\messages' error= 'The network path was not found.'

Finally if I attempt to Add Data>upload and point to the same file (\messages) I can successful ingest the file.

Re: Monitoring directory on a remote host

madavis1986 — Thu, 19 Jul 2018 15:33:20 GMT

Finally if I attempt to Add Data>upload and point to the same file (\messages) I can successful ingest the file.