Monitoring Splunk

Monitor remote directory on Windows machine

bwouters
Path Finder

I have a directory which is located on a Windows machine.
This directory contains a files and I'm particular interested of the content of those files.

My Splunk Enterprise is running on a Linux machine btw.

I got some data in using the Splunk Web UI but it seems that he's not monitoring all the time, it seems only once when I created the input..
All the examples I find related to putting the config manually in the inputs.conf file, seems to be related to Unix machines -> '/home/..something' but I need to monitor something like 'F:\Logs' and no idea how to write that in the inputs.conf.

Some questions
1. How can I do this the best?
2. What configuration is needed on the Enterprise server and UF?
3. The goal is eventually to put certain traffic on a dashboard. We want to show on a worldmap where and when people are making certain calls...

Thanks!

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

View solution in original post

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

bwouters
Path Finder

Ok, so you can put it literally 😉 Good to know! Thanks

0 Karma
Get Updates on the Splunk Community!

Let’s Talk Terraform

If you’re beyond the first-weeks-of-a-startup stage, chances are your application’s architecture is pretty ...

Cloud Platform | Customer Change Announcement: Email Notification is Available For ...

The Notification Team is migrating our email service provider. As the rollout progresses, Splunk has enabled ...

Save the Date: GovSummit Returns Wednesday, December 11th!

Hey there, Splunk Community! Exciting news: Splunk’s GovSummit 2024 is returning to Washington, D.C. on ...