All Apps and Add-ons

Unable to setup monitoring on shared network drive

mmohiuddin
Path Finder

I have data on a data mover that I would like Splunk to index the data. Unfortunately, we cannot setup UF on the data mover. I tried to created an inputs configuration to enable monitoring from this shared path. I am having access to this shared path as well.

[monitor:\simclrdat01\FinRec\WorkSpace\DollarU\DEV\lou01\Tad\AAA MCP Approved]
disabled = false
index = mcp_text
sourcetype = mcp_text_2
crcSalt =

But it doesn't seem to be working.

Please provide some inputs on how to get this working.

Thanks

Tags (1)
0 Karma

MillerTime
Splunk Employee
Splunk Employee

Your [monitor:xxx] value looks incorrectly formatted - please refer to the inputs.conf documentation:
http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf

Note the slashes from the documentation (that are missing from your stanza):
[monitor://]
* This directs Splunk to watch all files in .
* can be an entire directory or just a single file.
* You must specify the input type and then the path, so put three slashes in your path if you are starting
at the root (to include the slash that goes before the root directory).

I would also personally not include the crcSalt key if you're not going to give it a value, but it shouldn't affect the input.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...