topic How do you monitor a Windows shared directory? in Splunk Search

How do you monitor a Windows shared directory?

alonsocaio — Wed, 02 Jan 2019 15:26:52 GMT

I have Splunk Enterprise installed on a Linux Server. I need to monitor a Windows Shared Directory containing a CSV file that needs to be uploaded daily to Splunk.

Each time I try to create a monitor (Add Data -> Monitor -> Files & Directories) I get this error: "Parameter Name: Path must be absolute".

Is there any way to fix that? How can I check if the Splunk has access to the Windows shared directory?

Re: How do you monitor a Windows shared directory?

efavreau — Wed, 02 Jan 2019 17:26:07 GMT

Can you mount the windows directory?

Re: How do you monitor a Windows shared directory?

alonsocaio — Wed, 02 Jan 2019 17:28:16 GMT

I cannot mount the Windows directory in the Linux server that Splunk is installed.

Re: How do you monitor a Windows shared directory?

richgalloway — Wed, 02 Jan 2019 18:25:17 GMT

Install the Splunk Universal Forwarder on a Windows system that has access to the shared directory and configure it to monitor the file.

Re: How do you monitor a Windows shared directory?

efavreau — Thu, 03 Jan 2019 16:41:06 GMT

Look to see if you can mount the windows directory. If the windows directory looks like part of the Linux filesystem, and Splunk has the permissions to access the mount, it may work for you.

Re: How do you monitor a Windows shared directory?

alonsocaio — Thu, 03 Jan 2019 16:41:07 GMT

I mounted the directory using cifs-utils. It worked now. Thanks.

Re: How do you monitor a Windows shared directory?

efavreau — Thu, 03 Jan 2019 16:41:08 GMT

Glad it worked for you. I'll write up a short answer.

Re: How do you monitor a Windows shared directory?

joesrepsolc — Tue, 03 Mar 2020 23:13:32 GMT

This is difficult to do given a windows share sits on a VIP and is load balanced. So this is not as straight forward as it may seem.