Getting Data In

Windows Monitoring Stanza help

vrmandadi
Builder

I am trying to monitor the path:

\\host1\X$\Monitoring\Splunk\

Below is the stanza for it.
Am I doing anything wrong or do I need to add another "\" before the host

[monitor:\\host1\X$\Monitoring\Splunk\]
0 Karma

alonsocaio
Contributor

When I monitor windows dirs I use "monitor://" + Path. Have you tried something like this into you syntax?

[monitor://C:\Windows\Logs]
0 Karma

jdhunter
Path Finder

Is Splunk running as a Domain Account and have access to read the directory? If not, It will not be able to read any network drives, shares, etc.

0 Karma

VatsalJagani
Motivator

Hello @vrmandadi - I think you need to provide the complete (absolute) path to your directory. Like: C:\Users...\host1...

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!