topic Re: Windows Monitor Path for SPLUNK in Installation

How I would use monitor path in my inputs.conf?

SplunkDash — Mon, 19 Dec 2022 15:29:27 GMT

Hello,

How I would use monitor path in my inputs.conf. All files are in the Windows machine at the location:

MLTS(\\VPWSENTSHMS\CFT\TEST)(L:)

Should it be

[monitor://L:\MLTS\*]

Any recommendations will be highly appreciated. Thank you!

Re: Windows Monitor Path for SPLUNK

gcusello — Sat, 17 Dec 2022 06:09:07 GMT

Hi @SplunkDash,

if you have a fixed path, you can use the full path e.g.:

[monitor://L:\MLTS\VPWSENTSHMS\CFT\TEST\*.*]

[monitor://L:\MLTS\VPWSENTSHMS\CFT\*\*.*]

if instead you could have a variable path, you can use three dots:

[monitor://L:\MLTS\...\*.*]

Remember that in Windows you have to use "*.*" and not "*" as in Unix.

Ciao.

Giuseppe

Re: Windows Monitor Path for SPLUNK

SplunkDash — Sat, 17 Dec 2022 13:53:31 GMT

@gcusello

This is a great point, thank you, appreciated your support as always.

Re: Windows Monitor Path for SPLUNK

SplunkDash — Sun, 18 Dec 2022 01:06:22 GMT

@gcusello

How would I point path in monitor command if my source files are located in Windows Shared Folder? Is the following should work ("\\servername\comm2\Audit\Logs\" is share folder name) :

[monitor://\\servername\comm2\Audit\Logs\*.log]

Thank you so much!

Re: Windows Monitor Path for SPLUNK

gcusello — Sun, 18 Dec 2022 09:28:34 GMT

Hi @SplunkDash,

Using windows, you have to specify the drive you're using:

[monitor://F:\servername\comm2\Audit\Logs\*.log]

Anyway, you can test the path to insert in the monitor stanza header using the "dir" command in cmd window.

Ciao.

Giuseppe