Getting Data In

inputs.conf and Windows path

tlmayes
Contributor

I know this should be simple, but for whatever reason, it's not working

Have a production Windows 2012 server where we are collecting application logs from a log file. The path is
C:\Program Files\somepath..... so created an inputs.conf as follows

[monitor://C:\Program Files\somepath\]
index=someindex
sourcetype=somesourcetype
whitelist=\logfile.*$

Restarted the Windows UF service, no errors, but no events either (yes, confirmed there are events). So suspected permissions, and instead used:

    [monitor://C:\Test Folder\somepath\]
    index=someindex
    sourcetype=somesourcetype
    whitelist=\logfile.*$

Again, nothing, so used:

    [monitor://C:\TestFolder\somepath\]
    index=someindex
    sourcetype=somesourcetype
    whitelist=\logfile.*$

Without the whitespace, and works as expected. Put the whitespace back in, modified the log file so as to force collection, and again nothing. Was able to reproduce all on a 2012 test server. There is no provision I am aware of in inputs.conf to account for whitespace since it is supposed to be automatically recognized. What am I missing?

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi tlmayes,
did you already tried?

[monitor://C:\Program Files\somepath\logfile.*]
index=someindex
sourcetype=somesourcetype

Bye.
Giuseppe

View solution in original post

tlmayes
Contributor

Sometimes it is the simple things... Removing the recursive line fixed it

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi tlmayes,
did you already tried?

[monitor://C:\Program Files\somepath\logfile.*]
index=someindex
sourcetype=somesourcetype

Bye.
Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...