Can't collect data from file on windows host

[Alex_Rus]

My Splunk installation can't read files from windows host from a specific folder on the C:// drive. Logs are collected from another folder without problems. There are no errors in index _internal, stanza in inputs.conf looks standard, monitor on the folder and the path are specified correctly. The rights to the folder and files are system ones, as are other files that we can collect. What could be the problem?

[gcusello]

Hi @Alex_Rus ,

if you're sure about grants, please, could your share your inputs.conf and the full path of the unread files?

Ciao.

Giuseppe

[Alex_Rus]

Hi, @gcusello !

[monitor://C:\ExchData\MessageTracking\*]

disabled = 0

index = MyIndex

sourcetype = MySourcetype

#FcrcSalt = <SOURCE

[gcusello]

Hi @Alex_Rus ,

what if you run from cmd:

dir C:\ExchData\MessageTracking\*

?

Are you sure that there isn't another Splunk input that reads these logs?

Ciao.

Giuseppe 

[Alex_Rus]

Yes, I'm sure. I checked on Deployment-server there are no such folders for monitoring

[PickleRick]

Wait a second. You're mixing several things. One is the forwarder which is supposed to read the data. Another is a Deployment Server. You show a inputs.conf stanza pointing to a local directory but your screenshot shows listing of a network share.

We need much more words from you - what are you trying to ingest, how, where and so on.

[gcusello]

Hi @Alex_Rus ,

and what if yourun the cmd command?

Ciao.

Giuseppe

[Alex_Rus]

as in the photo, files in which events are stored

[gcusello]

Hi @Alex_Rus ,

so, if you run the above command from a cmd window, you have the list of the files in that folder, is it true?

If yes, the inputs.conf is correct, otherwise there's an error i the input path.

In addition, from the photo I cannot read the label in the first row, the one before the files, is it another folder or what else?

Ciao.

Giuseppe