topic Re: How can I add new text file everyday? in Getting Data In

How can I add new text file everyday?

maha110192 — Sat, 19 Feb 2022 05:37:18 GMT

Hello splunkies!

I'm trying to be and admin and I'm doing an exercise but I cannot find the way to configure my inputs.conf

here the exercise:

path: /logfiles/syslog/training-nix01.txt

This file will be updated continuously and will roll daily to training-nix01.1, training-nix01.1 etc

Data from these files should be written to

Index: Training

Sourcetype: tp:tr

any ideas?

gcusello — Sat, 19 Feb 2022 06:35:23 GMT

In few words, you have to configure the inputs.conf file and you have two ways to do this:

by GUI if the file is in the same Splunk Server,
manually modifying the inputs.conf file if the file is in a different server wher you have a Universal Forwarder.

in both cases, you'll have a new stanza in inputs.conf stanza:

[monitor://logfiles/syslog/training-nix*] disabled = 0 index = Training sourcetype = tp:tr

if you manually modify the inputs.conf file, you have to restart Splunk on the system where the file is located.

Ciao.

Giuseppe

maha110192 — Sat, 19 Feb 2022 06:46:20 GMT

Thank you very much @gcusello I was doing everthing right except the way to get a new text file daily.