Why am I unable to monitor files from a Windows universal forwarder using patterns?

[amitRG]

Hello,

I have a Windows universal forwarder from which I am unable to monitor some files.

I have a directory structure like this

D:/Data/Data-pages-ErrorLogs/31_Aug_2015/396364/523/ErrorManager/Exception523.html
D:/Data/Data-pages-ErrorLogs/30_Aug_2015/396345/678/ErrorManager/Exception678.html
....
D:/Data/Data-pages-ErrorLogs/30_Aug_2015/878975/987/ErrorManager/Exception987.html

There are 100s to 1000s files like this. That, and many folders.

I have tried the following, but Exception.html does NOT show up on the splunk server.

[monitor://D:/Data/pages-ErrorLogs/.../Exception*.*] -- monitor with file patterns
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager] -- monitor everything inside ErrorManager folders
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager/] -- with trailing slash
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager/*] -- with * at the end

I have
1. Looked at splunk forwarder logs. There are no errors there.
2. I can forward some other files fine from the forwarder. So connectivity between forwarder and the server is fine.

Please help.

Thanks,
-Amit

[seandevo]

Hi Amit,

It looks like your windows pathway in your monitor stanzas have foward slashes as opposed to backslashes. From my experience, the pathways in windows use backslashes instead of forward slashes (which linux uses). Have you verified that correct pathways of your directory?

If it is a windows directory, the monitor path should look like so:

[monitor://D:\Data\pages-ErrorLogs]

[somesoni2]

To be specific try this

 [monitor://D:\Data\pages\pages-ErrorLogs\...\ErrorManager\Exception*.log]

[amitRG]

Hello,

I tried with both forward and back slash - it makes no difference. I was not expecting any difference - windows works with both forward and back slash for a long time.