Does universal forwarder need to monitor each sub-folder of text files, or just the parent folder?

[bcusick]

HI, I'm trying to use a forwarder to monitor a network share. My forwarder sits on one server, and needs to read the network drive. I've monitored other drives remotely with this same domain account and server (and still doing so).

The only difference here is that this directory "\trades\" contains multiple folders, instead of just text files under "\trades\" as I've done previously. I've set up the inputs file and restarted the forwarder, but I don't see any data in Splunk yet.

Do I need to specifically monitor EACH sub-folder that contains text files? Or should I be able to just monitor from the parent folder down with some special command? Thanks.

[bcusick · Accepted solution]

It looks like this fizzled itself out. It took a while for Splunk to index everything (I'm guessing because the directory was large and across the network) but a few days later I have millions of events. 🙂

[yannK]

Splunk should by default look at sub folders too.
Please double check
- your monitor stanza and your whitelists/blacklists.
- the btool result of your inputs, to check is the option "recursive = false" is used

see http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/Inputsconf
and the btool http://docs.splunk.com/Documentation/Splunk/6.1.3/Troubleshooting/Usebtooltotroubleshootconfiguratio...

[martin_mueller]

What settings did you use in your inputs.conf?