topic Re: Monitor different sourcetype in sub-directories in Getting Data In

Monitor different sourcetype in sub-directories

lain179 — Tue, 11 Jun 2013 22:33:12 GMT

I have to monitor two source types in this following directory structure

\\Server\Path\{can be any name}.log == > sourcetype = FirstLog

\\Server\Path\SubPath\{can be any name}.csv == > sourcetype = SecondLog

How do I set up the inputs.conf? Right now, my first monitor for \\Server\Path is working but the next monitor for \\Server\Path\SubPath is not working.

Re: Monitor different sourcetype in sub-directories

JSapienza — Wed, 12 Jun 2013 18:21:58 GMT

Set the monitor specific to the file in your inputs.conf :

[monitor://\\Server\share\*.log]
sourcetype = FirstLog

[monitor://\\Server\Share\Directory\*.csv]
sourcetype = SecondLog

Re: Monitor different sourcetype in sub-directories

lain179 — Thu, 13 Jun 2013 17:17:39 GMT

Sorry, the slashes didn't show up correctly in my message. That's not what I need. I updated the message above.

Re: Monitor different sourcetype in sub-directories

JSapienza — Thu, 13 Jun 2013 17:24:15 GMT

The inputs.conf example should still work. If you are using UNC paths then you might want to take a look at this:
http://splunk-base.splunk.com/answers/35281/splunk-index-logs-from-network-drive

Re: Monitor different sourcetype in sub-directories

lain179 — Thu, 13 Jun 2013 18:20:53 GMT

Sorry, I don't understand what it has anything to do with my problem with assigning log files from subdirectories to different sourcetype.

*** Also I can't hard code the name of the log files because as I described log file name can vary. It can be any name.

Re: Monitor different sourcetype in sub-directories

JSapienza — Thu, 13 Jun 2013 18:32:01 GMT

It was a suggestion is you are have trouble accessing the files by UNC path. I modified the example to reflect using a wildcard for the file name.