Getting Data In
Highlighted

## Problem with network logs

Path Finder

I setup a data input from a network source. They are IIS logs and they reside on a networked drive. I setup the input to continuously monitor the directory. Splunk is not indexing the data. When I go into the splunkd log I see the following:

`WARN FilesystemChangeWatcher - error reading directory "\\Server\inetpub\logs\LogFiles\W3SVC4": The operation completed successfully.`

Any ideas on what I have done wrong or what other steps I need to take to get the data to index? Do I need to add entries into local .conf files? When I was building the dashboards I moved some of the log files locally to the splunk system and indexed them, the logs indexed with no issues. Any advice is welcomed.

Tags (3)
Highlighted

## Re: Problem with network logs

Legend

Does the account that is running Splunk have the domain-level access that is necessary to read directories on a network drive?

Highlighted

## Re: Problem with network logs

Path Finder

I can view the logs across the network while remoted into the system with the Splunk installation.

Highlighted

## Re: Problem with network logs

Legend

That is good - but what user are you signed in as? What user credentials does the Splunk service use?