About Highlander22

Highlander22 · ‎09-27-2021

Hi@LukeMurphey , I am hoping you can help with your File Meta-Data addon that I am hoping is just what I need. I have been trying to get it working for a while now but it just didn't seem to do anything after setting up my Data Input. I've done a bit more digging today in the 'file_meta_data_modular_input.log' log file and I am getting the following error reported: 2021-09-27 15:24:06,745 ERROR Execution failed Traceback (most recent call last): File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\modular_input.zip\modular_input\modular_input_base_class.py", line 1095, in execute self.do_run(in_stream, log_exception_and_continue=True) File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\modular_input.zip\modular_input\modular_input_base_class.py", line 976, in do_run self.run(stanza, cleaned_params, input_config) File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\file_meta_data.py", line 641, in run file_filter=file_filter) File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\file_meta_data.py", line 187, in get_files_data file_path = file_path.encode("utf-8") AttributeError: 'bytes' object has no attribute 'encode' As the error is caused in the bold line above in the .py file, I guess this may be something to do with my Splunk Enterprise (Free version) running on a Windows 10 machine, trying to index Windows volumes. FYI in my Data Input, it doesn't matter if I have the "File or directory path" as "L:\" or "L:" or anything else (i.e. I want to index my L:\ volume), it just reports this error. Sorry this is probably a noob question but any help would be appreciated. FYI I am using v1.4.5 of your add-on. Many thanks in advance.

Highlander22 · ‎11-03-2020

Thanks @gcusello & @richgalloway 😊👍 for taking the time to respond. I think I have the solution: I already had the "File Meta-data" app but was using the "Files & Directories" "Data Input" (which does index the contents of the file/all files in the directory) rather than the "File Meta-data" "Data Input" (which "Import[s] file and directory meta-data (size, modification dates, etc.)". This also adds a new "File Meta-data" entry in the "Add Data" "Monitor" sources too. I have it timed to run every 24 hours so will have to wait 24 hours for it to have triggered at some time in the interim. The documentation on that "File Meta-data" app is rather spartan to say the least but I think I am on the right path. Just need a bit of trial and error now, I think. I have upvoted both of you though 😊. @gcusello- In my old programming days, yes, I would have created such a script but I expected that such integrated tools like Splunk should be able to integrate directly with the FS by now to at least do that for me 😊. @richgalloway- If I can't get my expected solution to work (it bloody well should work), I will have a look at yours next. There's always different ways of skinning the same cat...though, yes, this is quite a primitive cat to have Splunk get its teeth into.

Highlander22 · ‎11-02-2020

Hi all, Sorry for the really newb question (because I am one). I have Splunk Enterprise running on my standalone PC to evaluate it. I have managed to get Splunk to monitor my PC's volumes, directories & files OK...but the **bleep** thing insists on trying to index the contents of every file too. Obviously, this is very resource-intensive and I really don't want the file contents indexed. How do I stop it indexing the file contents? Or, even better, tell it not to index any file contents except for specific file extensions? Thanks for any help.

Posts	3
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎11-02-2020

Online Status	Offline
Date Last Visited	‎09-27-2021 01:51 PM

Trouble indexing 'File Meta-Data' on Windows volum...

Monitoring File Directories but not indexing file ...

Trouble indexing 'File Meta-Data' on Windows volum...

Re: Monitoring File Directories but not indexing f...

Monitoring File Directories but not indexing file ...