Deployment Architecture

How can I log a file in windows in the users directory?

Path Finder

Hi,

I try to log a file which is located in a subfolder of C:\Users\%USERNAME%\ and I don't know how I can do this in the inputs.conf I tried different things but nothing worked. I tried to use the windows environment variables like $USERNAME or $HOMEPATH but both aren't working. Also I tried to set a new variable with set SPLUNK_USER="C:\Users\%USERNAME%\" or setx SPLUNK_USER C:\Users\%USERNAME%\ . Nothing worked.

Can someone help me or give me useful hint?

Kind regards

0 Karma
1 Solution

Builder

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

View solution in original post

Builder

Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\

[monitor://c:\Users\...\YOURFILENAME]

OR

[monitor://c:\Users\*\YOURFILENAME]

Or if there is a subdirectory where the file is, enter it.

[monitor://c:\Users\...\SUBDIR\YOURFILENAME]

-JD

View solution in original post

SplunkTrust
SplunkTrust

The first and last options will search all subdirectories, which may be undesirable.
Option 2 will search for YOURFILENAME in each user's top directory.
Changing the last option to [monitor://C:\Users\*\SUBDIR\YOURFILENAME] (where SUBDIR could be path) is probably best.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

Hi JDukeSplunk,

the solution with the asterix works. Kind regards.

0 Karma

Champion

Which username are you intending to get substituted?

0 Karma

Path Finder

Hi micahkemp,

I can't tell you the username because I didn't know it. The workstations are used by different users.

0 Karma