Monitoring Splunk

Monitor remote directory on Windows machine

bwouters
Path Finder

I have a directory which is located on a Windows machine.
This directory contains a files and I'm particular interested of the content of those files.

My Splunk Enterprise is running on a Linux machine btw.

I got some data in using the Splunk Web UI but it seems that he's not monitoring all the time, it seems only once when I created the input..
All the examples I find related to putting the config manually in the inputs.conf file, seems to be related to Unix machines -> '/home/..something' but I need to monitor something like 'F:\Logs' and no idea how to write that in the inputs.conf.

Some questions
1. How can I do this the best?
2. What configuration is needed on the Enterprise server and UF?
3. The goal is eventually to put certain traffic on a dashboard. We want to show on a worldmap where and when people are making certain calls...

Thanks!

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

View solution in original post

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

bwouters
Path Finder

Ok, so you can put it literally 😉 Good to know! Thanks

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...