Getting Data In

What's the syntax for monitoring a local windows directory or file?

Champion
[monitor://C:\\program files\path\filename]

doesn't seem to be working.

0 Karma
1 Solution

Champion

Ok, working now. In my testing I've found that both ways will work: [monitor://C:\stuff] and [monitor://C:\\stuff] work. Confirmed by trying both and seeing the source appear in metadata.

View solution in original post

0 Karma

Champion

Ok, working now. In my testing I've found that both ways will work: [monitor://C:\stuff] and [monitor://C:\\stuff] work. Confirmed by trying both and seeing the source appear in metadata.

View solution in original post

0 Karma

Champion

Splunk, I might have missed this but it would be useful for you to provide some Windows syntax examples either in spec file or online documentation. Thx.

Explorer
[monitor://C:\Program Files\path\filename]

might work
you seem to have a double-slash after C:, also not entirely sure of the case sensitiveness of Splunkd on windows, but just in case might want to preserve the case if you can for the entire path.
Regards,
Srinivas

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!