When defining a monitoring path in inputs.conf with space in the path, any Windows directory path with space in it is not working. There is a space in " Web Server Extensions". Is there a way defined monitoring path with a space in it? Other monitor inputs without spaces are working fine.
[monitor://C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\WebServices\LogFiles] disabled = false sourcetype = iis index = infra_sharepoint
My experience with Splunk v7.3 is that the [monitor] stanza understands 'spaces' as-is, i.e., nothing special needs to be done.
For instance, my 'inputs.conf' works correctly with the following:
[monitor://C:\Program Files (x86)\My App\Logs*\app.log*]
What does sourcetype have to do with spaces in the monitor:// statement? This answer is not helpful to me. I do not want to downvote it as it is not offensive, but it is not helpful either.
Can you clarify?
you mean you can just make up a sourcetype (and name it anything like "abciis")...?
Did you have to define "abciis" anywhere?
Did not work, as explained above.