topic Re: Indexing Sharepoint mounted path in Splunk in Monitoring Splunk

Indexing Sharepoint mounted path in Splunk?

PraveenaR — Mon, 31 Oct 2022 09:12:07 GMT

I am able to index my local C:/ drive local files in Splunk , but unable to index X:/ drive (Sharepoint path) folder data through inputs.conf.

Note:

X:/ drive contains the mounted path of Sharepoint location

Any help would be appreciated!

Thanks,
Praveena

Re: Indexing Sharepoint mounted path in Splunk

richgalloway — Sun, 30 Oct 2022 19:48:24 GMT

What happens when you try to index the X: drive? What error(s) do you get?

Is Splunk running as a user with access to that drive? See https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/ConsiderationsfordecidinghowtomonitorWindowsdata#Authentication_for_remote_Windows_data

Re: Indexing Sharepoint mounted path in Splunk

PraveenaR — Mon, 31 Oct 2022 09:26:57 GMT

Splunk has Domain Account.
Note:
My X: drive data are not reflecting in splunk web. (No Errors)

Re: Indexing Sharepoint mounted path in Splunk

richgalloway — Mon, 31 Oct 2022 13:25:36 GMT

It's surprising that Splunk would not index any data and not report anything about it. Did you check splunkd.log? What is the inputs.conf stanza for the X drive?

Re: Indexing Sharepoint mounted path in Splunk

PraveenaR — Mon, 31 Oct 2022 13:31:52 GMT

Monitoring Stanza:

[monitor://X:\ASERENS\ENX\ENX1\200_Licensing\100_SparxSystems-EA\OrderingLicsMaint\2021\*.txt]

Yeah, I checked the log as well, but couldn't find any errors.

Re: Indexing Sharepoint mounted path in Splunk

richgalloway — Mon, 31 Oct 2022 13:42:49 GMT

Where is the rest of the stanza? I expected to see more than the heading.

What query are you using to find the events from the X: drive?

Re: Indexing Sharepoint mounted path in Splunk

PraveenaR — Wed, 02 Nov 2022 06:59:58 GMT

@richgalloway , Thanks for the support!!

I found the issue for not reading the file from the sharepoint,

It is due to the access error (as you mentioned) in reading the file in sharepoint from Splunk.

I tried enabling the debug logs and found it.