Gettin news data by Universal Forwarder

michaelteck — Tue, 23 Apr 2024 15:03:06 GMT

Hello everyone,

I turn to you because I have a little problem. I have an MFT server that generates logs in a directory. In this directory the log files are stored in directories that have the name of the day. And the log files have the name 1000005847456.log. For example, today’s logs 23 April 2024 are stored in the 2024-04-23/ directory. For now, I have this input.conf file :

[monitor:///data/logs/.../100000*.log] disabled=false sourcetype=log4j host=PC followTail=0 index=test_wild

When I launch the Universal Forwarder, it starts listing all files in/data/logs/.../ . And it also starts to send the data in the log directory as of 4 days ago. I am not looking to retrieve the old log data but the log data of today. I don’t understand this behavior of the Universal Forwarder. Could someone help me?

Re: Gettin news data by Universal Forwarder

gcusello — Tue, 23 Apr 2024 15:12:40 GMT

Hi @michaelteck ,

if you give to the monitor command a path, Splunk reads all the file in this path.

You can exclude events older than a data (e.g. 1 day ago), adding a parameter to the input stanza

ignoreOlderThan = 1d

Ciao.

Giuseppe

topic Gettin news data by Universal Forwarder in Getting Data In

Gettin news data by Universal Forwarder

Re: Gettin news data by Universal Forwarder