Hello,
I have a Windows universal forwarder from which I am unable to monitor some files.
I have a directory structure like this
D:/Data/Data-pages-ErrorLogs/31_Aug_2015/396364/523/ErrorManager/Exception523.html
D:/Data/Data-pages-ErrorLogs/30_Aug_2015/396345/678/ErrorManager/Exception678.html
....
D:/Data/Data-pages-ErrorLogs/30_Aug_2015/878975/987/ErrorManager/Exception987.html
There are 100s to 1000s files like this. That, and many folders.
I have tried the following, but Exception.html does NOT show up on the splunk server.
[monitor://D:/Data/pages-ErrorLogs/.../Exception*.*] -- monitor with file patterns
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager] -- monitor everything inside ErrorManager folders
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager/] -- with trailing slash
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager/*] -- with * at the end
I have
1. Looked at splunk forwarder logs. There are no errors there.
2. I can forward some other files fine from the forwarder. So connectivity between forwarder and the server is fine.
Please help.
Thanks,
-Amit
... View more