How can I log a file in windows in the users directory?

[obrosch]

Hi,

I try to log a file which is located in a subfolder of C:\Users\%USERNAME%\ and I don't know how I can do this in the inputs.conf I tried different things but nothing worked. I tried to use the windows environment variables like $USERNAME or $HOMEPATH but both aren't working. Also I tried to set a new variable with set SPLUNK_USER="C:\Users\%USERNAME%\" or setx SPLUNK_USER C:\Users\%USERNAME%\ . Nothing worked.

Can someone help me or give me useful hint?

Kind regards

[JDukeSplunk · Accepted solution]

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

[richgalloway]

The first and last options will search all subdirectories, which may be undesirable.
Option 2 will search for YOURFILENAME in each user's top directory.
Changing the last option to [monitor://C:\Users\*\SUBDIR\YOURFILENAME] (where SUBDIR could be path) is probably best.

[obrosch]

Hi JDukeSplunk,

the solution with the asterix works. Kind regards.

[micahkemp]

Which username are you intending to get substituted?

[obrosch]

Hi micahkemp,

I can't tell you the username because I didn't know it. The workstations are used by different users.