topic Re: Can't collect data from file on windows host in Monitoring Splunk

Can't collect data from file on windows host

Alex_Rus — Mon, 14 Oct 2024 15:06:46 GMT

My Splunk installation can't read files from windows host from a specific folder on the C:// drive. Logs are collected from another folder without problems. There are no errors in index _internal, stanza in inputs.conf looks standard, monitor on the folder and the path are specified correctly. The rights to the folder and files are system ones, as are other files that we can collect. What could be the problem?

Re: Can't collect data from file on windows host

gcusello — Tue, 15 Oct 2024 06:31:22 GMT

Hi @Alex_Rus ,

if you're sure about grants, please, could your share your inputs.conf and the full path of the unread files?

Ciao.

Giuseppe

Re: Can't collect data from file on windows host

Alex_Rus — Tue, 15 Oct 2024 08:11:41 GMT

Hi, @gcusello !

[monitor://C:\ExchData\MessageTracking\*]

disabled = 0

index = MyIndex

sourcetype = MySourcetype

#FcrcSalt = <SOURCE

Re: Can't collect data from file on windows host

gcusello — Tue, 15 Oct 2024 08:29:43 GMT

Hi @Alex_Rus ,

what if you run from cmd:

dir C:\ExchData\MessageTracking\*

Are you sure that there isn't another Splunk input that reads these logs?

Ciao.

Giuseppe

Re: Can't collect data from file on windows host

Alex_Rus — Tue, 15 Oct 2024 08:34:35 GMT

Yes, I'm sure. I checked on Deployment-server there are no such folders for monitoring

Re: Can't collect data from file on windows host

gcusello — Tue, 15 Oct 2024 08:39:23 GMT

Hi @Alex_Rus ,

and what if yourun the cmd command?

Ciao.

Giuseppe

Re: Can't collect data from file on windows host

Alex_Rus — Tue, 15 Oct 2024 09:05:36 GMT

as in the photo, files in which events are stored

Re: Can't collect data from file on windows host

gcusello — Tue, 15 Oct 2024 10:08:23 GMT

Hi @Alex_Rus ,

so, if you run the above command from a cmd window, you have the list of the files in that folder, is it true?

If yes, the inputs.conf is correct, otherwise there's an error i the input path.

In addition, from the photo I cannot read the label in the first row, the one before the files, is it another folder or what else?

Ciao.

Giuseppe

Re: Can't collect data from file on windows host

PickleRick — Tue, 15 Oct 2024 11:11:13 GMT

Wait a second. You're mixing several things. One is the forwarder which is supposed to read the data. Another is a Deployment Server. You show a inputs.conf stanza pointing to a local directory but your screenshot shows listing of a network share.

We need much more words from you - what are you trying to ingest, how, where and so on.