Monitoring Splunk

Monitor doesn't work with env variable in inputs.conf

Nicholas_Key
Splunk Employee
Splunk Employee

I observed that none of the log files are not indexed into Splunk when I used the environment variable, in my case it's the Windows OS "$PROGRAMFILES" env variable. An example is as below:

[monitor://$PROGRAMFILES\logs\st*Server.log]

and there are two files in logs folder "startServer.log" and "stopServer.log".

However I noticed a different behavior when I used

[monitor://C:\Program Files\logs\st*Server.log]

Both "startServer.log" and "stopServer.log" are indexed into Splunk.

Is this a known limitation to only use the absolute path in the inputs.conf to monitor log files?

0 Karma

hazekamp
Builder

There is an example of this being used in the windows app. Looking at Win 2k8 environment variables I see a system variable of "windir". This leads me to believe it must be a system variable (or perhaps a user variable matching the user running the splunkd service), and is case insensitive.

[monitor://$WINDIR\WindowsUpdate.log]
sourcetype = WindowsUpdateLog
disabled = 1
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No. In fact, Splunk itself uses the $SPLUNK_HOME environment variable, and I have used Windows (and Unix) environment variables at other times in the monitor stanza headers. First, make sure that that variable is actually set. Also, I don't know if you need to specify it as $ProgramFiles, rather than $PROGRAMFILES. Finally, maybe there's a problem when you try to use environment variables with a wildcard (this seems likely) in which case you should probably specify the parent directory and the whitelist explicitly.

Lowell
Super Champion

Just again, FYI. When I upgraded these forwarders to 4.1.3, I had problems with BOTH of my previously provided examples. I'm now using the whitelist approach instead. (So it appears that there is some difference between how this worked in 4.0 and 4.1)

0 Karma

Lowell
Super Champion

For whatever it's worth, I have inputs stanzas that uses an environment variables, an alternate groups, and wildcards without any issues. Here are two examples that are working fine on a 4.0.11 install: [monitor://$SPNK_WMHOME\MWS\server\default\logs\20*_*\(_full_|install).log] and [monitor://$SPNK_WMHOME\IntegrationServer\logs\(server|stats|error|security)*.log*]

Nicholas_Key
Splunk Employee
Splunk Employee

i'll try adding "whitelist" in the monitor stanza and see how things go

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...