Windows: When I point my inputs.conf file to index the contents of a directory of files. The files live on a UNC share. I can index them once, however splunk does not seem to “follow” or index additional entries or changes to the files in that directory.
input.conf file in search/local/
[monitor://\\aaa1baa0000\Logs]
disabled = false
followTail = 1
host = WinLBWIEE
sourcetype = Peter
What happens if you put in two slashes for the UNC directory?
[monitor://\\aaa1baa0000Logs]
If that were the case then the initial indexing of the file would have been unsuccesful
Make sure that the Windows User that is running the services on the Indexer (splunkd and splunkweb) have permissions to view the files on the UNC path. If this is a system with a Universal Forwarder then the default Window's user is System and might not have permissions to view files located on the UNC path.
That was a copy and past mistake, it does have 2 \'s 🙂