Why is our Splunk Universal Forwarder not able to read the modification on a file under the path "C:\Program Files (x86)"?

[danielearangiom]

My Splunk Universal Forwarder is not able to read the modification on a file under the path "C:\Program Files (x86)"

My inputs.conf is:

[monitor://C:\Program Files (x86)\TeamViewer\TeamViewer13_Logfile.log]
sourcetype = TeamViewer:Connection:Client
index = teamviewer
disabled = 0
queue = indexQueue

What am I doing wrong? I cannot see anything about this file in splunkd.log.

[danielearangiom · Accepted solution]

I was missing props.conf, it is mandatory even if it is empty

[richgalloway]

@danielearangiomazza If your problem is resolved, please accept the answer to help future readers.

[richgalloway]

Does the forwarder have read access to the file?

[danielearangiom]

The file is setted r/w for everyone

[amiftah]

"Cannot read modification" does it mean that the file has been indexed, just the modification that you can't see on splunk?

[danielearangiom]

The destination index is still empty

[amiftah]

1. As @richgalloway mentioned, do you have read access to this file, check the permissions by executing ls -ll
2. Are the splunkd services running?
3. Did you create the teamviewer index in the indexer?
4. if you added that monitoring stanza manually in the inputs.conf, did you restart your universal forwarder after that?
5. Does your sourcetype exist in the indexer?
6. Retry without the queue = indexQueue?