https://community.splunk.com/t5/Getting-Data-In/How-to-Watch-Multiple-Log-Files-with-Similar-Names-with/m-p/577658#M102044 <P>No data at all</P> Tue, 07 Dec 2021 15:56:11 GMT yourknightmares 2021-12-07T15:56:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-Watch-Multiple-Log-Files-with-Similar-Names-with/m-p/577547#M102020 <P>Hi, I'm setting up Splunk Universal Forwarder to watch logs generated from an application I have in AWS Elastic Beanstalk. This is done by running shell script installing the Universal Forwarder and setting up monitors.</P><P>&nbsp;</P><P>Simple enough. The problem is my application logs into a rolling file, meaning after a certain amount of data has been entered into the file (10MB in this example) it then creates a new file in the same location named "example 1.log" then "example 2.log", etc.</P><P>&nbsp;</P><P>Currently I've tried using the below command to set up all the monitors with no success:</P><P><SPAN>/opt/splunkforwarder/bin/splunk add monitor "/var/logs/example*"</SPAN></P><P>&nbsp;</P><P><SPAN>How can I capture all the files it will create?</SPAN></P> Tue, 07 Dec 2021 06:03:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Watch-Multiple-Log-Files-with-Similar-Names-with/m-p/577547#M102020 yourknightmares 2021-12-07T06:03:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-Watch-Multiple-Log-Files-with-Similar-Names-with/m-p/577553#M102021 <P>What is the issue? Are you getting duplicate data or no data at all?</P> Tue, 07 Dec 2021 06:49:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Watch-Multiple-Log-Files-with-Similar-Names-with/m-p/577553#M102021 manjunathmeti 2021-12-07T06:49:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-Watch-Multiple-Log-Files-with-Similar-Names-with/m-p/577658#M102044 <P>No data at all</P> Tue, 07 Dec 2021 15:56:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Watch-Multiple-Log-Files-with-Similar-Names-with/m-p/577658#M102044 yourknightmares 2021-12-07T15:56:11Z