Getting Data In

Why am I unable to monitor files from a Windows universal forwarder using patterns?

amitRG
New Member

Hello,

I have a Windows universal forwarder from which I am unable to monitor some files.

I have a directory structure like this

D:/Data/Data-pages-ErrorLogs/31_Aug_2015/396364/523/ErrorManager/Exception523.html
D:/Data/Data-pages-ErrorLogs/30_Aug_2015/396345/678/ErrorManager/Exception678.html
....
D:/Data/Data-pages-ErrorLogs/30_Aug_2015/878975/987/ErrorManager/Exception987.html

There are 100s to 1000s files like this. That, and many folders.

I have tried the following, but Exception.html does NOT show up on the splunk server.

[monitor://D:/Data/pages-ErrorLogs/.../Exception*.*] -- monitor with file patterns
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager] -- monitor everything inside ErrorManager folders
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager/] -- with trailing slash
[monitor://D:/Data/pages-ErrorLogs/.../ErrorManager/*] -- with * at the end

I have
1. Looked at splunk forwarder logs. There are no errors there.
2. I can forward some other files fine from the forwarder. So connectivity between forwarder and the server is fine.

Please help.

Thanks,
-Amit

0 Karma

seandevo
Explorer

Hi Amit,

It looks like your windows pathway in your monitor stanzas have foward slashes as opposed to backslashes. From my experience, the pathways in windows use backslashes instead of forward slashes (which linux uses). Have you verified that correct pathways of your directory?

If it is a windows directory, the monitor path should look like so:

[monitor://D:\Data\pages-ErrorLogs]
0 Karma

somesoni2
SplunkTrust
SplunkTrust

To be specific try this

 [monitor://D:\Data\pages\pages-ErrorLogs\...\ErrorManager\Exception*.log]
0 Karma

amitRG
New Member

Hello,

I tried with both forward and back slash - it makes no difference. I was not expecting any difference - windows works with both forward and back slash for a long time.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...