When defining a monitoring path in inputs.conf with space in the path, any Windows directory path with space in it is not working. There is a space in " Web Server Extensions". Is there a way defined monitoring path with a space in it? Other monitor inputs without spaces are working fine.
[monitor://C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\WebServices\LogFiles] disabled = false sourcetype = iis index = infra_sharepoint
Can you clarify?
you mean you can just make up a sourcetype (and name it anything like "abciis")...?
Did you have to define "abciis" anywhere?
Did not work, as explained above.
What does sourcetype have to do with spaces in the monitor:// statement? This answer is not helpful to me. I do not want to downvote it as it is not offensive, but it is not helpful either.
I think this reply re source-type was voted Answer because the OP's problem was with source-type rather than the spaces in the file-name/path
My experience with Splunk v7.3 is that the [monitor] stanza understands 'spaces' as-is, i.e., nothing special needs to be done.
For instance, my 'inputs.conf' works correctly with the following:
[monitor://C:\Program Files (x86)\My App\Logs*\app.log*]