Data not incoming

[BoldKnowsNothin]

My dear comrades,

I'm facing something unreal. We just deployed application on the host that looks like [monitor://C:\Data\log\*].

Unfortunately we cannot see any entries on splunk.

But when I copied some files to another location on host and also we changed application to something like [monitor://C:\Program Files\Data\log\*]. It sends data. 

The folders permission etc are all same. Our application is hard coded so we cannot change the path just like this test.

Any help will be much appreciated

[Zane]

I guess you don't have permission of root directory of C drive, because it's worked when you place file into "C:\Program Files",  just check if you can create the new file (instead of folder) in roo directory of C drive. I guess you should only have permission to create folders now.

[VatsalJagani · Accepted solution]

@BoldKnowsNothin - Please check to see if you have any errors/warnings from that host as suggested by @SanjayReddy .

Also, check if Splunk service is run by a local user or System user on Windows and check if that user running Splunk service has permission to read logs from that folder.

I hope this helps!!!

[SanjayReddy]

Hi @BoldKnowsNothin 

Did you see any warning/error messages in splunkd.log for file you intially monitored. 
log messages in splunkd.log will help to troubleshoot furthur