Getting Data In

Why Monitoring a Directory is not working?

ninisimonishvil
Path Finder

Hello,

I have a folder with several files on desktop. (xml) files have same names but different numbering for ex: File1, File2. File3

I also set up a sourcetype with event breaking that I tested and it is working (if I'm uploading a file having several events)

However when I set Monitor the folder c:\path\File* Choose a sourcetype that I have created, after reviewing I'm directed to search page where there is no single event (I think those files inside my folder are not indexed)

can anyone suggest what can be a reason?

0 Karma

yahuja_splunk
Splunk Employee
Splunk Employee

A sample of the inputs.conf in a windows environment is below.

[monitor://C:\Program Files (x86)\Symantec\Symantec\data\dump\scm_admin.tmp]
sourcetype = symantec:ep:admin:file
index = symantec
disabled = false

make sure you are using the slashes correctly.

0 Karma

ninisimonishvil
Path Finder

[monitor://C:\Users\Administrator\Desktop\Folder\BEX*]

This is my monitoring path.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...