Deployment Architecture

How can I log a file in windows in the users directory?

obrosch
Path Finder

Hi,

I try to log a file which is located in a subfolder of C:\Users\%USERNAME%\ and I don't know how I can do this in the inputs.conf I tried different things but nothing worked. I tried to use the windows environment variables like $USERNAME or $HOMEPATH but both aren't working. Also I tried to set a new variable with set SPLUNK_USER="C:\Users\%USERNAME%\" or setx SPLUNK_USER C:\Users\%USERNAME%\ . Nothing worked.

Can someone help me or give me useful hint?

Kind regards

0 Karma
1 Solution

JDukeSplunk
Builder

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

View solution in original post

JDukeSplunk
Builder

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

richgalloway
SplunkTrust
SplunkTrust

The first and last options will search all subdirectories, which may be undesirable.
Option 2 will search for YOURFILENAME in each user's top directory.
Changing the last option to [monitor://C:\Users\*\SUBDIR\YOURFILENAME] (where SUBDIR could be path) is probably best.

---
If this reply helps you, Karma would be appreciated.
0 Karma

obrosch
Path Finder

Hi JDukeSplunk,

the solution with the asterix works. Kind regards.

0 Karma

micahkemp
Champion

Which username are you intending to get substituted?

0 Karma

obrosch
Path Finder

Hi micahkemp,

I can't tell you the username because I didn't know it. The workstations are used by different users.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...