Deployment Architecture

How can I log a file in windows in the users directory?

obrosch
Path Finder

Hi,

I try to log a file which is located in a subfolder of C:\Users\%USERNAME%\ and I don't know how I can do this in the inputs.conf I tried different things but nothing worked. I tried to use the windows environment variables like $USERNAME or $HOMEPATH but both aren't working. Also I tried to set a new variable with set SPLUNK_USER="C:\Users\%USERNAME%\" or setx SPLUNK_USER C:\Users\%USERNAME%\ . Nothing worked.

Can someone help me or give me useful hint?

Kind regards

0 Karma
1 Solution

JDukeSplunk
Builder

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

View solution in original post

JDukeSplunk
Builder

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

richgalloway
SplunkTrust
SplunkTrust

The first and last options will search all subdirectories, which may be undesirable.
Option 2 will search for YOURFILENAME in each user's top directory.
Changing the last option to [monitor://C:\Users\*\SUBDIR\YOURFILENAME] (where SUBDIR could be path) is probably best.

---
If this reply helps you, Karma would be appreciated.
0 Karma

obrosch
Path Finder

Hi JDukeSplunk,

the solution with the asterix works. Kind regards.

0 Karma

micahkemp
Champion

Which username are you intending to get substituted?

0 Karma

obrosch
Path Finder

Hi micahkemp,

I can't tell you the username because I didn't know it. The workstations are used by different users.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...