Why the error PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY ERROR" when trying to monitor logs on a server?

[woodlandrelic]

HI

I am trying to monitor logs on a server. I have a UF in it and am trying to ./splunk add monitor.

When I put the path, index and so on. I keep getting this error " PARAMETER NAME: PATH MUST BE A FILE OR DIRECTORY" I have gone thru tons of questions on here but no one answer this particular question. 

Thanks for your help.

[richgalloway]

Please tell us the exact CLI command you are using to add the monitor.  What platform is the UF on?  It may be necessary to put the file path in quotes.

[woodlandrelic]

Hi @richgalloway 

The application is Linux. The app is StoneBranch 

The commands from  opt/splunkforwarder/bin

./splunk add monitor 

[richgalloway]

The add monitor command takes at least one argument so specifying just "splunk add monitor" is going to fail.  See splunk help add monitor

splunk add monitor -source /var/log -index os -sourcetype foo

[woodlandrelic · Accepted solution]

Hi @richgalloway 

So, what I did was as I went into

/opt/splunkforwarder/etc/apps/search/Splunk_TA/local

Then vi inputs.conf 

Created the monitor stanza saved and restart.

Voila and  my data is popping .

Thank you guys. Am finding way around splunk.

[isoutamo]

When you are adding a monitor you must add also path to file or to directory as a parameter to the splunk add monitor command. You should do like this

./splunk add monitor /opt/foo/bar/var/log/file.log

See more from https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI

r. Ismo 

[proft]

That is understood, but the Splunk Universal Forwarder 'splunk' utility is buggy and sometimes will not accept even a fully-qualified filename path.  Today we deployed identical rules for identical files across 100 servers, and about 20 of them failed with this error for no apparent reason.