Monitoring Splunk

Can't collect data from file on windows host

Alex_Rus
Loves-to-Learn Lots

My Splunk installation can't read files from windows host from a specific folder on the C:// drive. Logs are collected from another folder without problems. There are no errors in index _internal, stanza in inputs.conf looks standard, monitor on the folder and the path are specified correctly. The rights to the folder and files are system ones, as are other files that we can collect. What could be the problem?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alex_Rus ,

if you're sure about grants, please, could your share your inputs.conf and the full path of the unread files?

Ciao.

Giuseppe

0 Karma

Alex_Rus
Loves-to-Learn Lots

Hi, @gcusello !

[monitor://C:\ExchData\MessageTracking\*]

disabled = 0

index = MyIndex

sourcetype = MySourcetype

#FcrcSalt = <SOURCE

1000014647.jpg

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alex_Rus ,

what if you run from cmd:

dir C:\ExchData\MessageTracking\*

?

Are you sure that there isn't another Splunk input that reads these logs?

Ciao.

Giuseppe 

0 Karma

Alex_Rus
Loves-to-Learn Lots

Yes, I'm sure. I checked on Deployment-server there are no such folders for monitoring

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Wait a second. You're mixing several things. One is the forwarder which is supposed to read the data. Another is a Deployment Server. You show a inputs.conf stanza pointing to a local directory but your screenshot shows listing of a network share.

We need much more words from you - what are you trying to ingest, how, where and so on.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alex_Rus ,

and what if yourun the cmd command?

Ciao.

Giuseppe

0 Karma

Alex_Rus
Loves-to-Learn Lots

as in the photo, files in which events are stored

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alex_Rus ,

so, if you run the above command from a cmd window, you have the list of the files in that folder, is it true?

If yes, the inputs.conf is correct, otherwise there's an error i the input path.

In addition, from the photo I cannot read the label in the first row, the one before the files, is it another folder or what else?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...