Getting Data In

Monitor specific path in Windows

hagjos43
Contributor

We are trying to monitor a specific .log file in Windows 2k3 and 2k8. For example:

D:\logfiles\log123.log

We opened the "D:\Program Files\Splunk\etc\system\local\inputs.conf" Then added the line:

[monitor://D:\logfiles\log123.log]

Saved the file, restarted the service and waited. No data from that path came into the splunk server. It is reporting data from the WMI Security logs, but not the path stated above. We DONT want to reinstall the forwarders on every machine every time we need to make a change (we plan to use a deployment server in the future too). I read that this is possible but can't figure out why it isn't work.

Any help would be greatly appreciated. Thank you.

Tags (1)

yannK
Splunk Employee
Splunk Employee

The inputs.conf looks correct. Please restart splunk and check the internal logs in %SPLUNK_HOME%\var\log\splunk\splunkd.log for any errors or warnings.

hagjos43
Contributor

I looked in the var\log\splunkd.log file for errors and we are seeing this immediately under the specified path:
BatchReader = State transitioning from 2 to 0 (initOrResume).

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...