Windows log file data is not coming

[sekhar463]

hai 

i have configured below log file stanza but not getting data into splunk from windows UF

having latest on Jan 4th but those data also not came 
is any parameter need to add ?

below is the config file 

[monitorNoHandle://C:\Program Files\Crestron\CCS400\User\Logs\CCSFirmwareUpdate.txt]
index=Testindx
sourcetype=test_sourcetype
disabled=0

[dural_yyz]

https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Inputsconf

[MonitorNoHandle://<path>]

* This input intercepts file writes to the specific file.

It appears this monitor config does not read the file itself but only intercepts what is about to be written to the file.  Your image shows last modified as Jan 4th which is your stated last ingest.

I think your configuration will only capture future content and not existing content. 

[sekhar463]

still not coming 

the file is text file as below and its under Program Files\Crestron\CCS400\User\Logs\

and want to ingest the file CCSFirmwareUpdate.txt

[gcusello]

Hi @sekhar463 ,

which user are you using to run Splunk, has this user the grants to read this file?

please check that the path of the file is correct, runing the dir command in a cmd window.

Ciao.

Giuseppe

[PickleRick]

1. Do you get _any_ data from this forwarder? Especially events into _internal index.

2. Do you see any errors in c:\program files\splunk (or SplunkUniversalForwarder, depending on version)\var\log\splunk\splunkd.log on the forwarder?

3. What is the output of

splunk list monitor

and

splunk list inputstatus

run on your UF?

[gcusello]

Hi @sekhar463,

I suppose that you already configured outputs.conf and that you're already reeving logs from that machine.

Please try this:

[monitor://C:\Program Files\Crestron\CCS400\User\Logs\CCSFirmwareUpdate.txt]
index=Testindx
sourcetype=test_sourcetype
disabled=0

Ciao.

Giuseppe