Monitoring Splunk

Monitor remote directory on Windows machine

bwouters
Path Finder

I have a directory which is located on a Windows machine.
This directory contains a files and I'm particular interested of the content of those files.

My Splunk Enterprise is running on a Linux machine btw.

I got some data in using the Splunk Web UI but it seems that he's not monitoring all the time, it seems only once when I created the input..
All the examples I find related to putting the config manually in the inputs.conf file, seems to be related to Unix machines -> '/home/..something' but I need to monitor something like 'F:\Logs' and no idea how to write that in the inputs.conf.

Some questions
1. How can I do this the best?
2. What configuration is needed on the Enterprise server and UF?
3. The goal is eventually to put certain traffic on a dashboard. We want to show on a worldmap where and when people are making certain calls...

Thanks!

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

View solution in original post

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

bwouters
Path Finder

Ok, so you can put it literally 😉 Good to know! Thanks

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...