Hi,
I try to log a file which is located in a subfolder of C:\Users\%USERNAME%\
and I don't know how I can do this in the inputs.conf
I tried different things but nothing worked. I tried to use the windows environment variables like $USERNAME
or $HOMEPATH
but both aren't working. Also I tried to set a new variable with set SPLUNK_USER="C:\Users\%USERNAME%\"
or setx SPLUNK_USER C:\Users\%USERNAME%\
. Nothing worked.
Can someone help me or give me useful hint?
Kind regards
Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\
[monitor://c:\Users\...\YOURFILENAME]
OR
[monitor://c:\Users\*\YOURFILENAME]
Or if there is a subdirectory where the file is, enter it.
[monitor://c:\Users\...\SUBDIR\YOURFILENAME]
-JD
Try this for your inputs.conf stanza. I can't remember if dots or * works.. so try both. I think it's \...\
[monitor://c:\Users\...\YOURFILENAME]
OR
[monitor://c:\Users\*\YOURFILENAME]
Or if there is a subdirectory where the file is, enter it.
[monitor://c:\Users\...\SUBDIR\YOURFILENAME]
-JD
The first and last options will search all subdirectories, which may be undesirable.
Option 2 will search for YOURFILENAME in each user's top directory.
Changing the last option to [monitor://C:\Users\*\SUBDIR\YOURFILENAME]
(where SUBDIR could be path) is probably best.
Hi JDukeSplunk,
the solution with the asterix works. Kind regards.
Which username are you intending to get substituted?
Hi micahkemp,
I can't tell you the username because I didn't know it. The workstations are used by different users.