Monitor specific path in Windows

[hagjos43]

We are trying to monitor a specific .log file in Windows 2k3 and 2k8. For example:

D:\logfiles\log123.log

We opened the "D:\Program Files\Splunk\etc\system\local\inputs.conf" Then added the line:

[monitor://D:\logfiles\log123.log]

Saved the file, restarted the service and waited. No data from that path came into the splunk server. It is reporting data from the WMI Security logs, but not the path stated above. We DONT want to reinstall the forwarders on every machine every time we need to make a change (we plan to use a deployment server in the future too). I read that this is possible but can't figure out why it isn't work.

Any help would be greatly appreciated. Thank you.

[yannK]

The inputs.conf looks correct. Please restart splunk and check the internal logs in %SPLUNK_HOME%\var\log\splunk\splunkd.log for any errors or warnings.

• Splunk is case sensitive, check the path and filename
• Maybe the splunk service doesn't has read permissions on the file/folder, check permissions
• Maybe the file is skipped because it is considered as a duplicate (see http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/HowLogFileRotationIsHandled )

[hagjos43]

I looked in the var\log\splunkd.log file for errors and we are seeing this immediately under the specified path:
BatchReader = State transitioning from 2 to 0 (initOrResume).