Getting Data In

inputs.conf and Windows path

tlmayes
Contributor

I know this should be simple, but for whatever reason, it's not working

Have a production Windows 2012 server where we are collecting application logs from a log file. The path is
C:\Program Files\somepath..... so created an inputs.conf as follows

[monitor://C:\Program Files\somepath\]
index=someindex
sourcetype=somesourcetype
whitelist=\logfile.*$

Restarted the Windows UF service, no errors, but no events either (yes, confirmed there are events). So suspected permissions, and instead used:

    [monitor://C:\Test Folder\somepath\]
    index=someindex
    sourcetype=somesourcetype
    whitelist=\logfile.*$

Again, nothing, so used:

    [monitor://C:\TestFolder\somepath\]
    index=someindex
    sourcetype=somesourcetype
    whitelist=\logfile.*$

Without the whitespace, and works as expected. Put the whitespace back in, modified the log file so as to force collection, and again nothing. Was able to reproduce all on a 2012 test server. There is no provision I am aware of in inputs.conf to account for whitespace since it is supposed to be automatically recognized. What am I missing?

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi tlmayes,
did you already tried?

[monitor://C:\Program Files\somepath\logfile.*]
index=someindex
sourcetype=somesourcetype

Bye.
Giuseppe

View solution in original post

tlmayes
Contributor

Sometimes it is the simple things... Removing the recursive line fixed it

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi tlmayes,
did you already tried?

[monitor://C:\Program Files\somepath\logfile.*]
index=someindex
sourcetype=somesourcetype

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...