Automatically Upload all files in a folder from windows machine into Splunk with Splunk web option.

[siddharth1679]

I tried "Files and Directories" option, but getting following error.

unable to open file: path='\localhost\D$\Uploadfiles\' error='No such file or directory'

I am local user of the system, want to upload the CSV files stored in a particular folder (D or E folder).The Splunk version used is 6.2 . In some case i get this error "Parameter name: Path must be absolute". I tried these things
\localhost\D:\foldername or \IP-address of local system\D:\foldername or \localhost\D$\foldername.

I refereed "Splunk answers sight" but couldn't find out the answer.
I tried with two browsers Mozilla and Chrome, but getting same error in both. Since i have only access to Splunk UI i want to try with Splunk web option. Can't try with CLI and inputs.conf file as i don't have access to Splunk server. I am new to Splunk so can i be guided to solve this

[siddharth1679]

Hi FrankVl thanks for your reply. I shared the sub folder where the CSV file presents as "share with" option(selected Everyone). I need to know whether i am right in making the sub folder in windows as sharable or else need your help here. But now am confused what to do further for making splunk server accessible the shared sub folder. The splunk server is deployed in Centos 6. so i need further help.

Thanks in advance

[FrankVl]

You need to figure out what the share name is that windows generated when you enabled sharing. This should be visible in the sharing dialog of that folder somewhere.

[siddharth1679]

Ya i came to know about the share name. The share name is "\host name\folder name", i mentioned this in the "file and directories" path "\ip address\\host name\folder name" as you suggested, but now i am getting "Path must be absolute". If you can figure out what is the mistake can you help me out.

Thanks for your time.

[FrankVl]

On what OS is the splunk instance running? If that is linux, I don't think you can put such windows share paths into the "add data" wizard like that. You may first need to get that share mounted on the splunk server, such that you can refer to it from the "Add Data" page in Splunk Web.

Alternatively, if you just want to ingest these files once (and don't want to actually set up a permanent file monitor on that shared folder), you can simply choose the "Upload" option on the Add Data landing page.

[FrankVl · Accepted solution]

Just to clarify: you have CSV files on your local system and want to ingest those into Splunk, which is running on another server (to which you don't have access other than through Splunk Web)?

Telling Splunk to look at localhost, will have Splunk look at the system it is running on, not your local system.

So you would need to ensure the folder on your local system is shared, also accessible by the user splunk is running under and then ensure you put the correct share path into Splunk. When configuring the sharing of the folder on your local system, I think it should tell you under which path it is available for others?

It should be something like:
\ip-address or hostname of your local system\sharename\subfoldername