Getting Data In
Highlighted

Windows Monitoring Stanza help

Builder

I am trying to monitor the path:

\\host1\X$\Monitoring\Splunk\

Below is the stanza for it.
Am I doing anything wrong or do I need to add another "\" before the host

[monitor:\\host1\X$\Monitoring\Splunk\]
0 Karma
Highlighted

Re: Windows Monitoring Stanza help

Motivator

Hello @vrmandadi - I think you need to provide the complete (absolute) path to your directory. Like: C:\Users...\host1...

0 Karma
Highlighted

Re: Windows Monitoring Stanza help

Communicator

When I monitor windows dirs I use "monitor://" + Path. Have you tried something like this into you syntax?

[monitor://C:\Windows\Logs]
0 Karma
Highlighted

Re: Windows Monitoring Stanza help

Path Finder

Is Splunk running as a Domain Account and have access to read the directory? If not, It will not be able to read any network drives, shares, etc.

0 Karma