topic Why am I not able to ingest logs from a NAS mapped drive? in Getting Data In

Why am I not able to ingest logs from a NAS mapped drive?

csharm21 — Mon, 25 Mar 2019 13:08:37 GMT

Hi all,

I am trying to ingest data from a Windows server from one mapped NAS drive. But i am not able to do it due to the below reason.

First i mapped the NAS drive on the Windows machine but the Splunk forwarder is not able to see the drive.
Then i also tried using the UNC path, but in this case, Splunk is trying to read the NAS files but it give "Permission denied issue"
I also tried creating shortcut of NAS drive. In this case, also Splunk forwarder is able to read the file system but says "Permission denied issue". Can anyone help me to fix this?

Thanks in advance.

Re: Why am I not able to ingest logs from a NAS mapped drive?

schose — Mon, 25 Mar 2019 13:45:45 GMT

Hi,

mapped windows drives are user specific. When spunkforwarder should access logs from a mapped drive, the drive have to be mapped in the user context where UF is running.

Permissions denied may indicate, that your UF is running as system user. In that case the COMPUTERNAME$ account have to be used to grant access rights.

Re: Why am I not able to ingest logs from a NAS mapped drive?

csharm21 — Tue, 26 Mar 2019 11:16:45 GMT

Thanks for the response. I not that good in windows could you please help me to uderstand " COMPUTERNAME$ account have to be used to grant access rights" who can we grant this access