Getting Data In

What's the syntax for monitoring a local windows directory or file?

the_wolverine
Champion
[monitor://C:\\program files\path\filename]

doesn't seem to be working.

0 Karma
1 Solution

the_wolverine
Champion

Ok, working now. In my testing I've found that both ways will work: [monitor://C:\stuff] and [monitor://C:\\stuff] work. Confirmed by trying both and seeing the source appear in metadata.

View solution in original post

0 Karma

the_wolverine
Champion

Ok, working now. In my testing I've found that both ways will work: [monitor://C:\stuff] and [monitor://C:\\stuff] work. Confirmed by trying both and seeing the source appear in metadata.

0 Karma

the_wolverine
Champion

Splunk, I might have missed this but it would be useful for you to provide some Windows syntax examples either in spec file or online documentation. Thx.

schava2
Explorer
[monitor://C:\Program Files\path\filename]

might work
you seem to have a double-slash after C:, also not entirely sure of the case sensitiveness of Splunkd on windows, but just in case might want to preserve the case if you can for the entire path.
Regards,
Srinivas

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...