topic Re: collect data from a folder, but it is a disk in Monitoring Splunk

collect data from a folder, but it is a disk

Alex_Rus — Tue, 27 Aug 2024 15:27:32 GMT

I need to collect data from a folder on a Windows machine, the problem is that this folder is mounted as a disk and the host sends data to it. The classic inputs.conf for the folder source does not work. How can I fix this problem?

Re: collect data from a folder, but it is a disk

richgalloway — Tue, 27 Aug 2024 16:48:46 GMT

Tell us more. What exactly do you mean by "does not work"? What results/errors do you get? What is the inputs.conf stanza for that input?

Re: collect data from a folder, but it is a disk

gcusello — Tue, 27 Aug 2024 17:19:28 GMT

Hi @Alex_Rus ,

if the disk is always mounted with the same name, you can put it in your inputs.conf:

[monitor://E:\my_foler\my_files.log]

Ciao.

Giuseppe

Re: collect data from a folder, but it is a disk

Alex_Rus — Wed, 28 Aug 2024 09:03:02 GMT

Hi, Giuseppe! Thank you for your answer.

Let me explain the situation. The application is configured to collect logs from four hosts, on two of which the data is collected in the internal storage C:\Program Files\Microsoft\Exchange Server\... and the data comes from these hosts correctly. On the other two hosts the data is collected in a folder that is moved to a separate disk C:\MyFolder\MyFolder1\*.

My stanza looks like:

[monitor://C:/MyFolder\MyFolder1/*]

disabled = 0

index = MyIndex1

sourcetype = MySourcetype1

[monitor://C:/Program Files/Microsoft/Exchange Server/.../*]

disabled = 0

index = MyIndex1

sourcetype = MySourcetype1#

Re: collect data from a folder, but it is a disk

Alex_Rus — Wed, 28 Aug 2024 09:05:23 GMT

Hi, richgalloway! Thank you for your answer.

I wrote this information in response to the previous question from Giuseppe.

Re: collect data from a folder, but it is a disk

gcusello — Wed, 28 Aug 2024 09:05:57 GMT

Hi @Alex_Rus ,

I don't know if it's a mistyping, but you have to use backslashes in windows paths:

[monitor://C:\MyFolder\MyFolder1\*] disabled = 0 index = MyIndex1 sourcetype = MySourcetype1 [monitor://C:\Program Files\Microsoft\Exchange Server\...\*] disabled = 0 index = MyIndex1 sourcetype = MySourcetype1#

Ciao.

Giuseppe

Re: collect data from a folder, but it is a disk

Alex_Rus — Wed, 28 Aug 2024 09:11:18 GMT

Yes, it is a mistyping, in my inputs.conf i got it right.

Re: collect data from a folder, but it is a disk

gcusello — Wed, 28 Aug 2024 09:23:14 GMT

Hi @Alex_Rus ,

What's the problem?

you can have two different stanzas for your two different inputs with the same other parameters.

Ciao.

Giuseppe

Re: collect data from a folder, but it is a disk

Alex_Rus — Wed, 28 Aug 2024 09:42:31 GMT

the problem is that data from hosts where data is coming to a mounted disk does not come to Splunk

Re: collect data from a folder, but it is a disk

gcusello — Wed, 28 Aug 2024 10:03:56 GMT

Hi @Alex_Rus ,

what's the resul runnung from cmd:

dir C:\MyFolder\MyFolder1\*

if you haven't results, maybe the path isn't correct

or maybe there's another issue:

could data be equal to the ones from another input?

if they are the same, even if from a differen file, Splunk by default doesn't index a log twice.

Ciao.

Giuseppe