Deployment Architecture

How can I log a file in windows in the users directory?

obrosch
Path Finder

Hi,

I try to log a file which is located in a subfolder of C:\Users\%USERNAME%\ and I don't know how I can do this in the inputs.conf I tried different things but nothing worked. I tried to use the windows environment variables like $USERNAME or $HOMEPATH but both aren't working. Also I tried to set a new variable with set SPLUNK_USER="C:\Users\%USERNAME%\" or setx SPLUNK_USER C:\Users\%USERNAME%\ . Nothing worked.

Can someone help me or give me useful hint?

Kind regards

0 Karma
1 Solution

JDukeSplunk
Builder

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

View solution in original post

JDukeSplunk
Builder

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

richgalloway
SplunkTrust
SplunkTrust

The first and last options will search all subdirectories, which may be undesirable.
Option 2 will search for YOURFILENAME in each user's top directory.
Changing the last option to [monitor://C:\Users\*\SUBDIR\YOURFILENAME] (where SUBDIR could be path) is probably best.

---
If this reply helps you, Karma would be appreciated.
0 Karma

obrosch
Path Finder

Hi JDukeSplunk,

the solution with the asterix works. Kind regards.

0 Karma

micahkemp
Champion

Which username are you intending to get substituted?

0 Karma

obrosch
Path Finder

Hi micahkemp,

I can't tell you the username because I didn't know it. The workstations are used by different users.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...