Monitoring Splunk

Monitor remote directory on Windows machine

bwouters
Path Finder

I have a directory which is located on a Windows machine.
This directory contains a files and I'm particular interested of the content of those files.

My Splunk Enterprise is running on a Linux machine btw.

I got some data in using the Splunk Web UI but it seems that he's not monitoring all the time, it seems only once when I created the input..
All the examples I find related to putting the config manually in the inputs.conf file, seems to be related to Unix machines -> '/home/..something' but I need to monitor something like 'F:\Logs' and no idea how to write that in the inputs.conf.

Some questions
1. How can I do this the best?
2. What configuration is needed on the Enterprise server and UF?
3. The goal is eventually to put certain traffic on a dashboard. We want to show on a worldmap where and when people are making certain calls...

Thanks!

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

View solution in original post

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

bwouters
Path Finder

Ok, so you can put it literally 😉 Good to know! Thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...