UNC failed to follow files in a directory

[davecroto]

Windows: When I point my inputs.conf file to index the contents of a directory of files. The files live on a UNC share. I can index them once, however splunk does not seem to “follow” or index additional entries or changes to the files in that directory.

input.conf file in search/local/

[monitor://\\aaa1baa0000\Logs]
disabled = false
followTail = 1
host = WinLBWIEE
sourcetype = Peter

[tgow]

What happens if you put in two slashes for the UNC directory?

[monitor://\\aaa1baa0000Logs]

[davecroto]

If that were the case then the initial indexing of the file would have been unsuccesful

[tgow]

Make sure that the Windows User that is running the services on the Indexer (splunkd and splunkweb) have permissions to view the files on the UNC path. If this is a system with a Universal Forwarder then the default Window's user is System and might not have permissions to view files located on the UNC path.

[davecroto]

That was a copy and past mistake, it does have 2 \'s 🙂