universal forwarder cannot find the path which I want to specify

[p1004]

When I install the universal forwarder on my DHCP server, I want to monitor the DHCP folder under system32, but from the software, when I use "path to monitor", I cannot find the DHCP folder through Directory, can you let me know why?

[Runals]

You using the case sensitive path to your logs? Since you haven't posted the path to your own and you mention system32 I'm guessing the path is the default one. This has worked for me.

[monitor://C:\WINDOWS\system32\dhcp]
sourcetype = DhcpSrvLog
crcSalt = <SOURCE>
disabled = false
whitelist = Dhcp.+\.log

[p1004]

Thanks for your answer, I am running a domain admin account, and it is in the local admin group, the permission should not be a problem.

[ShaneNewman]

Is Splunk setup to run as a system account or a domain account? If it is setup as a domain account, it may not have the correct permissions to that directory.

[ShaneNewman]

If you browse the folder directory as the domain account on the server itself, can you see the files you want to monitor?