Monitoring Splunk

Monitor remote directory on Windows machine

bwouters
Path Finder

I have a directory which is located on a Windows machine.
This directory contains a files and I'm particular interested of the content of those files.

My Splunk Enterprise is running on a Linux machine btw.

I got some data in using the Splunk Web UI but it seems that he's not monitoring all the time, it seems only once when I created the input..
All the examples I find related to putting the config manually in the inputs.conf file, seems to be related to Unix machines -> '/home/..something' but I need to monitor something like 'F:\Logs' and no idea how to write that in the inputs.conf.

Some questions
1. How can I do this the best?
2. What configuration is needed on the Enterprise server and UF?
3. The goal is eventually to put certain traffic on a dashboard. We want to show on a worldmap where and when people are making certain calls...

Thanks!

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

View solution in original post

woodcock
Esteemed Legend

You have it right:

[monitor://F:\Path\To\YourFileHere.log]
index=YourIndexHere
sourcetype=YourSourcetypeHere

bwouters
Path Finder

Ok, so you can put it literally 😉 Good to know! Thanks

0 Karma
Get Updates on the Splunk Community!

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...