Getting Data In

How to monitor a CSV files which is placed in a NFS file share?

Hemnaath
Motivator

Hi All,

We have request from end user for monitoring a CSV files which are placed in the file share folder and there is no splunk agent running in the file share machine.

Example :  Server01  is the actual application which is generating a report and Server02 is the file share machine where the reports are stored and shared with the user. 

\\fileshare\power\Powerfile\TO\IAM\Export Files\OSBD - Terminated Users List.csv  --  Location of the file to be monitored in splunk.  

Above mentioned path has required permission to access the file from the share drive

In Server01 we have splunk UF agent running and inputs.conf configured for monitoring the log files present in the server.  

Question:

 Can we use the same app which is present in the server01 to monitor the file present in the server02 as it has the required permission to access the file from that server.

Stanza in inputs.conf: 

[monitor://\fileshare\power\Powerfile\TO\IAM\Export Files\OSBD - Terminated Users List.csv]
sourcetype = powerfile:power:osbd_terminateduser
index = indexname
disabled = 0
ignoreOlderThan = 14d

kindly guide me how to get this share folder to be monitored in splunk.

Labels (4)
0 Karma

PickleRick
Ultra Champion

Firstly, it doesn't seem like NFS, more like CIFS.

Anyway.

With NFS you mount the remote filesystem in a directory and just monitor your source files like you would normally do with local file using full path with mounted directory.

With CIFS you can simpy call the file by its UNC path. Just remember that the user the splunk UF runs with has to have proper access to the file (which usually means that you'd not be running the UF as Local System.

0 Karma

Hemnaath
Motivator

Any update on this post will help us to solve the problem. 

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...