How I would use monitor path in my inputs.conf?

[SplunkDash]

Hello,

How I would use monitor path in my  inputs.conf. All files are in the Windows machine at the location:

MLTS(\\VPWSENTSHMS\CFT\TEST)(L:)

Should it be

[monitor://L:\MLTS\*]

Any recommendations will be highly appreciated. Thank you!

[gcusello · Accepted solution]

Hi @SplunkDash,

if you have a fixed path, you can use the full path e.g.:

[monitor://L:\MLTS\VPWSENTSHMS\CFT\TEST\*.*]

or

[monitor://L:\MLTS\VPWSENTSHMS\CFT\*\*.*]

if instead you could have a variable path, you can use three dots:

[monitor://L:\MLTS\...\*.*]

Remember that in Windows you have to use "*.*" and not "*" as in Unix.

Ciao.

Giuseppe

[SplunkDash]

@gcusello 

How would I point path in monitor command if my source files are located in Windows Shared Folder? Is the following should work ("\\servername\comm2\Audit\Logs\" is share folder name) :

[monitor://\\servername\comm2\Audit\Logs\*.log]

Thank you so much!

[gcusello]

Hi @SplunkDash,

Using windows, you have to specify the drive you're using:

[monitor://F:\servername\comm2\Audit\Logs\*.log]

Anyway, you can test the path to insert in the monitor stanza header using the "dir" command in cmd window. 

Ciao.

Giuseppe

[SplunkDash]

@gcusello 

This is a great point, thank you, appreciated your support as always.