I want to monitor the Sailpoint.log file on a Windows client. I've put both the full path and just the directory. The last to lines in the file have been both commented and uncommented. I've also run btool to see if there is a syntax error.
I am very new to this and more of a linux guy. Is this syntax correct? If so can someone give me the precise syntax to use for a search?
Your last 2 lines are commented out. Remove the '#' from each line so it reads:
disabled = false
whitelist = .log
Then to verify that log files are being indexed, you can run the following search (with the correct time frame selected)
This will return any files that have been indexed in that directory.
I've tried it multiple times and still doesn't work.
I don't have direct access to the server so I have a Windows admin running commands and he's tried **splunk add monitor c:\Identity IQ\
error : Must be in the form '-parameter value"
C:\Program Files\SplunkUniversalForwarder\bin>splunk add monitor “c:\Identity IQ\”
Same error message. Using both inputs.conf and CLI it fails. Can't be this hard to just add this path. Been looking for answers out here for over a day with no luck. Did this in linux in 5 minutes. Suggestions would greatly be appreciated.
Did this resolve your issue? If so, I can move the comment by brad_thomas to an answer so you could mark it accepted?
If not, then no worries, just post back with what it's doing now! (Personally, I thought you need a backslash at the end of the monitor stanza name, but I can certainly be wrong).