Installation

How I would use monitor path in my  inputs.conf?

SplunkDash
Motivator

Hello,

How I would use monitor path in my  inputs.conf. All files are in the Windows machine at the location:

MLTS(\\VPWSENTSHMS\CFT\TEST)(L:)

Should it be

[monitor://L:\MLTS\*]

Any recommendations will be highly appreciated. Thank you!

 

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @SplunkDash,

if you have a fixed path, you can use the full path e.g.:

[monitor://L:\MLTS\VPWSENTSHMS\CFT\TEST\*.*]

or

[monitor://L:\MLTS\VPWSENTSHMS\CFT\*\*.*]

if instead you could have a variable path, you can use three dots:

[monitor://L:\MLTS\...\*.*]

Remember that in Windows you have to use "*.*" and not "*" as in Unix.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @SplunkDash,

if you have a fixed path, you can use the full path e.g.:

[monitor://L:\MLTS\VPWSENTSHMS\CFT\TEST\*.*]

or

[monitor://L:\MLTS\VPWSENTSHMS\CFT\*\*.*]

if instead you could have a variable path, you can use three dots:

[monitor://L:\MLTS\...\*.*]

Remember that in Windows you have to use "*.*" and not "*" as in Unix.

Ciao.

Giuseppe

SplunkDash
Motivator

@gcusello 

How would I point path in monitor command if my source files are located in Windows Shared Folder? Is the following should work ("\\servername\comm2\Audit\Logs\" is share folder name) :

[monitor://\\servername\comm2\Audit\Logs\*.log]

Thank you so much!

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SplunkDash,

Using windows, you have to specify the drive you're using:

[monitor://F:\servername\comm2\Audit\Logs\*.log]

Anyway, you can test the path to insert in the monitor stanza header using the "dir" command in cmd window. 

Ciao.

Giuseppe

SplunkDash
Motivator

@gcusello 

This is a great point, thank you, appreciated your support as always.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...