Getting Data In

Matching Windows path in props.conf

matthewjohnson
Explorer

I'm trying to set up the Splunk for A10 Networks app.

It expects syslog data on UDP port 514.

My data is collected by NXLog, spit out into a file, and then consumed by Splunk.

As such, I'm trying to edit a props.conf stanza in the app's directory from it's default, [source::udp:514] to match my file path.

Example path:

D:\syslog\a10networks&adc_a10networks\[device name]\[file name].syslog.

How would I construct my source stanza?

I've tried many variations along the lines of, [source::D:\\...\\a10networks&adc_a10networks\\....syslog] (I have tried escaping the ampersand in my path). I'm running Splunk on Windows if it matters.

0 Karma

lguinn2
Legend

I think that this is what you need in props.conf if there is only one layer of directories represented by [device name]

[source::D:\syslog\a10networks&adc_a10networks\*\*.syslog]

This will work if the directory structure is more complicated

[source::D:\syslog\a10networks&adc_a10networks\...\*.syslog]

matthewjohnson
Explorer

I tried your example, with and without escaped backslashes, and still couldn't get it to work. I'm wondering if it isn't related to the '&' in the path. In the end, I assigned a source type (a10) via Splunk file & folder monitoring, and replaced my [source::...] stanza with [a10]. Now everything is working.

0 Karma

MuS
SplunkTrust
SplunkTrust

How about the & in the path name, does this work? I can remember a bug which did not like $ in path names.

MuS
SplunkTrust
SplunkTrust

Hi matthewjohnson,

you can use something like this in your inputs.conf :

 [monitor://D:\syslog\...\*.syslog]

which will recurses through the directories in side of syslog.

Hope this helps ...

cheers, MuS

matthewjohnson
Explorer

Thanks for the input. @lguinn is correct, I'm editing an app and am working with props.conf

0 Karma

lguinn2
Legend

Yes, this is good for inputs.conf, but I think he may be editing an app, in which case he probably needs to edit props.conf as well...

That's a little different.

PS. I corrected the typo in your monitor stanza (missing ])

MuS
SplunkTrust
SplunkTrust

HeHe, twice good spotting @lguinn

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...