We are trying to monitor a lot of systems that have various configurations of drives, (C:disk 😧 cdrom, c:disk d: disk e: disk f: cdrom, etc). The issue we are seeing is that with the below inputs.conf we are getting millions of "device not ready" messages in _internal index when splunk tries to look at the CDrom drive. Is there any way to force splunk not to check the CD drive If we don't know what drive the CD is? (I can't change the drive letter of the CDrom, and I can't change what drive the data is on).. so somtiems d: is a hard drive, sometimes 😧 is a CDrom (and we get the errors). This is a problem with both monitor & batch.
Thoughts?
error:
12-21-2012 18:06:25.979 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "d:\splunk_logs\application": The device is not ready.
inputs.conf:
[batch://d:\splunk_logs\applicaton\*.txt|*.csv]
move_policy = sinkhole
disabled = false
[batch://e:\splunk_logs\application\*.txt|*.csv]
move_policy = sinkhole
disabled = false
