Getting Data In

How to pull in logs from User's Appdata

vishalduttauk
Communicator

Hi there,

 

I am trying to ingest data which is stored within the profile of a user's AddData location:

C:\Users\(User ID)\AppData\Local\UiPath\Logs but can't pull in any events. I've tried lots of different stanzas

like 

[monitor://C:\Users\DKX*\AppData\
[monitor://C:\Users\DKX$\AppData\
[monitor://C:\Users\...\AppData\
[monitor://C:\Users\%userprofile%\AppData\


Any idea why it isn't working? I know i've not added in all my stanza attempts but could it be due to the Splunk service account not having access to that location?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please detail what is mean by "it isn't working".  What happens when you try those monitor stanzas?  What errors are reported?  Does the account running Splunk have read access to the files?  Why do you your monitor stanza names end with "AppData" when you want to ingest "AppData\Local\UiPath\Logs"?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...