I am getting an "is not absolute. This is a configuration error and may not work / break things. Change this path to an absolute path." error on the first entry in my conf file.
[monitor://D:Program Files\system\AB\LogFiles\error.log
disabled = false
sourcetype = error
[WinEventLog://System]
disabled = 0
sourcetype = SystemEvtLog
I believe its due to the space between Program and Files. I have tried various wildcards with no success.
Windows 2003
Splunk 6.0.1
Suggestions appreciated.
Are you missing a close paren? ]
Was it just a paste issue that you are also missing the backslashes?