Splunk Search

UNC failed to follow files in a directory

davecroto
Splunk Employee
Splunk Employee

Windows: When I point my inputs.conf file to index the contents of a directory of files. The files live on a UNC share. I can index them once, however splunk does not seem to “follow” or index additional entries or changes to the files in that directory.

input.conf file in search/local/

[monitor://\\aaa1baa0000\Logs]
disabled = false
followTail = 1
host = WinLBWIEE
sourcetype = Peter

Tags (1)
0 Karma

tgow
Splunk Employee
Splunk Employee

What happens if you put in two slashes for the UNC directory?

[monitor://\\aaa1baa0000Logs]
0 Karma

davecroto
Splunk Employee
Splunk Employee

If that were the case then the initial indexing of the file would have been unsuccesful

0 Karma

tgow
Splunk Employee
Splunk Employee

Make sure that the Windows User that is running the services on the Indexer (splunkd and splunkweb) have permissions to view the files on the UNC path. If this is a system with a Universal Forwarder then the default Window's user is System and might not have permissions to view files located on the UNC path.

0 Karma

davecroto
Splunk Employee
Splunk Employee

That was a copy and past mistake, it does have 2 \'s 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...