topic Re: File monitor wildcard not matching? in Splunk Enterprise

File monitor wildcard not matching?

jdmclemore — Fri, 01 Sep 2017 22:20:02 GMT

I'm trying to monitor a catalina logs that look like this:

/home/loader/logs/catalina.2017-09-01.log

with this file monitor stanza:

[monitor:///home/loader/logs/catalina.*.log]
disabled = false
sourcetype = catalina

But I'm not seeing any data. Any reason why that wildcard would not match that file?

ddrillic — Sat, 02 Sep 2017 02:38:31 GMT

It should. For sanity check, I would put [monitor:///home/loader/logs/catalina.2017-09-01.log] if you haven't done it yet... index=main?

woodcock — Sat, 02 Sep 2017 15:40:50 GMT

You haven't told it what index to go to. Try this for a test:

[monitor:///home/loader/logs/catalina.*.log]
disabled = false
sourcetype = catalina
index = main

burwell — Mon, 04 Sep 2017 19:29:52 GMT

Like Woodcock suggests, be sure you have index=main on your search
For a quick search, change the time period to All Time. Perhaps you are having time parsing issues. Oftentimes I find my data is in Splunk. I am just looking in the wrong time interval.
Look in the forwarder logs when you restart Splunk and make sure that the forwarder is monitoring the directory you expect
Check to make sure that the user who runs Splunk can read the logs.

jdmclemore — Tue, 05 Sep 2017 22:58:51 GMT

Thanks for the suggestions...turned out to be user error. 🙂 My wildcard DID match the file name.