Files & Directories: Path does not exist

[kmattern]

I have four files in the same directory, "/opt/SplunkData". I can see three of them in "Manager » Data inputs » Files & Directories" but whever I attempt to create a new data input for the fourth I get the following error:

Encountered the following error while trying to save: In handler 'monitor': Path does not exist..

I do not have access to the command line, the conf files, etc because of DoD security.

I have verified the spelling over and over. There are no spaces in the file names. Can anyone tell me why I am getting this error?

[jbsplunk]

Without access to the command line, it is difficult to say. I've only seen this error in relation to files/folders that don't exist. However, perhaps there are permissions issues that could cause similar behavior. Have you attempted to set up monitor stanza on the folder /opt/SplunkData/ without regard to the actual file names? You could white list the files you wanted to index explicitly so nothing else would be indexed. Perhaps that would allow you to determine what is occurring.

If you still weren't seeing data under this condition, perhaps you could look at the rest endpoint by going to

https://yoursplunkserver:8089/services/admin/inputstatus/TailingProcessor:FileStatus

This should give you a list of everything that Splunk thinks its monitoring, how far it has been read, and the size at the time of the last read. If it failed to read, it should tell you the reason for that as well.

[kmattern]

Thanks for your input. Next week when my contact has returned I will try editing the inputs.conf. Unfortunately the URL you gave me will not work because this is a DoD computer sitting on a military reservation and port 8089 is not open. Access to Splunk is strictly controlled. Maybe when I am out there next week I will be able to access it from inside the system but from where I sit, if I can’t see it from Manager, I cannot see it!

[kmattern]

It is simply a list of pdf files. The entire set of files are all .CSV They are identical in content, composed of three columns a customer name, the number of PDF files it was supposed to get and the number that were actually delivered. The fourth file is simply one field wide and, as I said above, is a list of all the individual PDF files that have been delivered to customers.

[rogue_carrot]

I have a directory and files that I can tab complete on the command line in linux but I receive this error. If I can tab complete the path to the file I want to monitor then I know for sure the file is there otherwise I would not be able to tab complete to the file.

I am completely confused. I think this must be a permissions issue as the splunk user may not have the same permissions as the normal user on this operating system (OS) that created these files. I did add the splunk user to the main group that the main user is in though so they appear to have the same permissions from my perspective. Thanks for asking this question. Frustrating/confusing situation.

[rogue_carrot]

I just gave read and write privileges to the file i want splunk to monitor to the splunk user and now I receive the errror, "bash: ./splunk: Permission denied". 😕 Things changed when I changed the privileges but still I have an error.

[jbsplunk]

What does the fourth input look like vs the first, second, etc.?