topic Re: how to monitoring same file. it is different location file. in Splunk Enterprise

how to monitoring same file. it is different location file.

YUNHYEONG — Wed, 02 Sep 2020 07:59:33 GMT

hello splunker.

I would like to monitor the same file in another folder as below.

each host is a folder name.

it is works in one app.

The file names in the folder may be the same or different.

my setting : input.conf

[monitor://D:\Splunk\Check\TEST*\*.csv]
disabled = false
host_regex =
index = test
host =
host_segment = 3
sourcetype = testcheck
crcSalt = <<SOURCE>>

ty help me

Re: how to monitoring same file. it is different location file.

rnowitzki — Wed, 02 Sep 2020 09:27:05 GMT

Hi @YUNHYEONG ,

There is one issue with the host segment, let me quote the Documentation:

* On Windows machines, the drive letter and colon before the backslash count
  as one segment.
    * For example, if you set host_segment=3 and the monitor path is
      D:\logs\servers\host01, Splunk software sets the host as "servers" because
      that is the third segment.

So it would need to be host_segment = 4 in your case.

Other than that I don't see a problem with the settings.
What does not work for you, besides the host assignment?

BR
Ralph

Re: how to monitoring same file. it is different location file.

YUNHYEONG — Thu, 03 Sep 2020 06:52:23 GMT

hello @rnowitzki

you means that i can same file monitoring at my setting?

i testing but, only some data is monitored.

ex) host : TEST1, TEST3

It also attempted to set up at host_segment = 4.

The result was that the host name was a file name. not folder name

is it ok. host_segment = 3

my problem is that some of the same files in other folders are monitored. why???? T_T

ty so much.

Re: how to monitoring same file. it is different location file.

rnowitzki — Thu, 03 Sep 2020 07:41:11 GMT

Hi @YUNHYEONG,

Yes, it should ingest all the files matching the path pattern.
Can you share some examples of files that are not getting indexed? (full path and filename).

Also, is the problem that you are monitoring too few files or too many files?
=> Because you wrote "only some data is monitored." vs. "some of the same files in other folders are monitored"...

BR
Ralph