topic inputs.conf is there a difference in Splunk Enterprise

inputs.conf is there a difference

gerdhuber — Thu, 16 Feb 2017 13:00:17 GMT

Hallo,

i only want to monitor files in the directory pkorb and not files in subdirectory pkorb/oldlogs
What is the right monitor ?

[monitor:///var/log/pkorb]
[monitor:///var/log/pkorb/]

or any other ?

Re: inputs.conf is there a difference

martin_mueller — Thu, 16 Feb 2017 13:25:02 GMT

I'd give this a shot:

[monitor:///var/log/pkorb]
recursive = false

Alternatively, this:

[monitor:///var/log/pkorb]
blacklist = oldlogs

The latter would recurse, but skip the oldlogs directory. See http://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/inputsconf for specs.

Re: inputs.conf is there a difference

skoelpin — Thu, 16 Feb 2017 13:31:16 GMT

[monitor:///var/log/pkorb/*] will forward any files sitting in the pkorb directory but will NOT forward files from sub-directories in that pkorb directory

If you wanted to ingest data from a subdirectory, it would look like

[monitor:///var/log/pkorb/.../*]

Re: inputs.conf is there a difference

gerdhuber — Fri, 17 Feb 2017 09:01:42 GMT

thank you

Re: inputs.conf is there a difference

skoelpin — Fri, 17 Feb 2017 13:01:06 GMT

Did this answer your question? If so then please accept the answer

Re: inputs.conf is there a difference

gerdhuber — Mon, 20 Feb 2017 10:18:56 GMT

yes, this is what i am looking for.

Re: inputs.conf is there a difference

skoelpin — Mon, 20 Feb 2017 13:04:12 GMT

Can you please accept the answer and close it out?