All Apps and Add-ons

NFS mount on a Windows Server 2008 R2

oliah
Engager

I created a NFS export to /etc/log on my NetApp then mount this share on the Splunk Windows Server.

[monitor:///N:]

But the filer is not showing up in the dashboard. How can I troubleshoot this?
- Is there any special config to mount the NFS share?
- What are the credentials used to access to the NFS share?

dwaddle
SplunkTrust
SplunkTrust

Some things may be playing a part here.

  1. It doesn't need to be an NFS mount necessarily, you could use CIFS (assuming your filers support CIFS and so on). Splunk just needs access to the /vol/vol0/etc/log on the filer. But, there may be other factors below that affect this negatively.
  2. On my filers, there is a broken symbolic link in /vol/vol0/etc/log that points messages -> /etc/messages. Which is not correct. It should be messages -> ../messages. If I recreate this link properly, Netapp eventually breaks it. (This may play a dual-role in #1 above because I don't know if you mount it via CIFS if the symlinks will work at all)
  3. Maybe [monitor://N:] ? The third slash there is (usually) for a unix absolute path. (But I'm not a Windows person so I may have this wrong)
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...