collect data from a folder, but it is a disk

[Alex_Rus]

I need to collect data from a folder on a Windows machine, the problem is that this folder is mounted as a disk and the host sends data to it. The classic inputs.conf for the folder source does not work. How can I fix this problem?

[gcusello]

Hi @Alex_Rus ,

if the disk is always mounted with the same name, you can put it in your inputs.conf:

[monitor://E:\my_foler\my_files.log]

Ciao.

Giuseppe

[Alex_Rus]

Hi, Giuseppe! Thank you for your answer.

Let me explain the situation. The application is configured to collect logs from four hosts, on two of which the data is collected in the internal storage C:\Program Files\Microsoft\Exchange Server\... and the data comes from these hosts correctly. On the other two hosts the data is collected in a folder that is moved to a separate disk C:\MyFolder\MyFolder1\*.

My stanza looks like:

[monitor://C:/MyFolder\MyFolder1/*]

disabled = 0

index = MyIndex1

sourcetype = MySourcetype1

[monitor://C:/Program Files/Microsoft/Exchange Server/.../*]

disabled = 0

index = MyIndex1

sourcetype = MySourcetype1#

[gcusello]

Hi @Alex_Rus ,

I don't know if it's a mistyping, but you have to use backslashes in windows paths:

[monitor://C:\MyFolder\MyFolder1\*]
disabled = 0
index = MyIndex1
sourcetype = MySourcetype1

[monitor://C:\Program Files\Microsoft\Exchange Server\...\*]
disabled = 0
index = MyIndex1
sourcetype = MySourcetype1#

Ciao.

Giuseppe

[Alex_Rus]

Yes, it is a mistyping, in my inputs.conf i got it right.

[gcusello]

Hi @Alex_Rus ,

What's the problem?

you can have two different stanzas for your two different inputs with the same other parameters.

Ciao.

Giuseppe

[Alex_Rus]

the problem is that data from hosts where data is coming to a mounted disk does not come to Splunk

[gcusello]

Hi @Alex_Rus ,

what's the resul runnung from cmd:

dir C:\MyFolder\MyFolder1\*

?

if you haven't results, maybe the path isn't correct

or maybe there's another issue:

could data be equal to the ones from another input?

if they are the same, even if from a differen file, Splunk by default doesn't index a log twice.

Ciao.

Giuseppe

[richgalloway]

Tell us more.  What exactly do you mean by "does not work"?  What results/errors do you get?  What is the inputs.conf stanza for that input?

[Alex_Rus]

Hi, richgalloway! Thank you for your answer. 

I wrote this information in response to the previous question from Giuseppe.