I have a Windows universal forwarder from which I am unable to monitor some files.
I have a directory structure like this
D:/Data/Data-pages-ErrorLogs/31_Aug_2015/396364/523/ErrorManager/Exception523.html D:/Data/Data-pages-ErrorLogs/30_Aug_2015/396345/678/ErrorManager/Exception678.html .... D:/Data/Data-pages-ErrorLogs/30_Aug_2015/878975/987/ErrorManager/Exception987.html
There are 100s to 1000s files like this. That, and many folders.
I have tried the following, but Exception.html does NOT show up on the splunk server.
[monitor://D:/Data/pages-ErrorLogs/.../Exception*.*] -- monitor with file patterns [monitor://D:/Data/pages-ErrorLogs/.../ErrorManager] -- monitor everything inside ErrorManager folders [monitor://D:/Data/pages-ErrorLogs/.../ErrorManager/] -- with trailing slash [monitor://D:/Data/pages-ErrorLogs/.../ErrorManager/*] -- with * at the end
1. Looked at splunk forwarder logs. There are no errors there.
2. I can forward some other files fine from the forwarder. So connectivity between forwarder and the server is fine.
It looks like your windows pathway in your monitor stanzas have foward slashes as opposed to backslashes. From my experience, the pathways in windows use backslashes instead of forward slashes (which linux uses). Have you verified that correct pathways of your directory?
If it is a windows directory, the monitor path should look like so: