Splunk Search
Highlighted

Does universal forwarder need to monitor each sub-folder of text files, or just the parent folder?

Communicator

HI, I'm trying to use a forwarder to monitor a network share. My forwarder sits on one server, and needs to read the network drive. I've monitored other drives remotely with this same domain account and server (and still doing so).

The only difference here is that this directory "\trades\" contains multiple folders, instead of just text files under "\trades\" as I've done previously. I've set up the inputs file and restarted the forwarder, but I don't see any data in Splunk yet.

Do I need to specifically monitor EACH sub-folder that contains text files? Or should I be able to just monitor from the parent folder down with some special command? Thanks.

0 Karma
Highlighted

Re: Does universal forwarder need to monitor each sub-folder of text files, or just the parent folder?

SplunkTrust
SplunkTrust

What settings did you use in your inputs.conf?

0 Karma
Highlighted

Re: Does universal forwarder need to monitor each sub-folder of text files, or just the parent folder?

Splunk Employee
Splunk Employee

Splunk should by default look at sub folders too.
Please double check
- your monitor stanza and your whitelists/blacklists.
- the btool result of your inputs, to check is the option "recursive = false" is used

see http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/Inputsconf
and the btool http://docs.splunk.com/Documentation/Splunk/6.1.3/Troubleshooting/Usebtooltotroubleshootconfiguratio...

Highlighted

Re: Does universal forwarder need to monitor each sub-folder of text files, or just the parent folder?

Communicator

It looks like this fizzled itself out. It took a while for Splunk to index everything (I'm guessing because the directory was large and across the network) but a few days later I have millions of events. 🙂

View solution in original post

0 Karma