topic Re: Wildcards in source name in inputs.conf in Getting Data In

Wildcards in source name in inputs.conf

jpashak — Thu, 08 Sep 2022 18:38:18 GMT

We are monitoring log files that rotate multiple times daily. We have wildcards specified in the monitor command, but do not in the source command. Our issue arises when the software that generates the logs is updated and we have to update the paths in our inputs.conf.

Here is a sample stanza:

[monitor:///apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV_*] index=peoplesoft sourcetype=peoplesoft_appsrv source=/apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV.LOG

What we would like to do is something along these lines so version changes don't require Splunk changes:

[monitor:///apps/psprd*/.../APPSRV_*] index=peoplesoft sourcetype=peoplesoft_appsrv source=/apps/psprd*/.../APPSRV.LOG

I have notes from my predecessor that we can't do that because you cannot specify a wildcard on the source line. We want the full pathname for the source.

Is this limitation still in effect or can it be done?

Thanks In Advance!

Jeff

Re: Wildcards in source name in inputs.conf

richgalloway — Thu, 08 Sep 2022 19:32:07 GMT

Leave out the source specifier. Splunk will get the source value from the file it reads.

Re: Wildcards in source name in inputs.conf

jpashak — Thu, 08 Sep 2022 19:43:36 GMT

I understand that. In our case, we want the source to not contain the changing value in the filename, to give the appearance the source is the same for all of these.

Example:

The file name is /apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV_0908.LOG

We want the source to be

/apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV.LOG

not /apps/psprdcs/pt8.58/config/sprdcs/appserv/SPRDCS/LOGS/APPSRV_0908.LOG