topic Re: Splunk Universal forwarder inputs.conf in Getting Data In

Splunk Universal forwarder inputs.conf

ajaybguthi — Fri, 15 Mar 2013 17:43:19 GMT

Hi,

My issue is i need to monitor only 3 folders out of 9 folders is there any way that i can do this in the inputs.conf instead of adding all 3 folders and the files under them in separate monitor statements

ex:

Folder names are xxx1,xxx2,xxx3,......xxx9

i only need data from 1,2,3 folders , and multiple files under them

so in monitor statement in inputs.conf

/mnt/qa/xxx1/appslog/yyy/filename.log

instead of having statements for all 3 folders , can i do it one single monitor statement for all 3 folders if am monitoring files with same names under them ( by not including folders xxx4---xxx9

Re: Splunk Universal forwarder inputs.conf

starcher — Fri, 15 Mar 2013 19:15:29 GMT

You could try something like the below. I think it might work. I have a blacklist version of that setup to skip certain folders under /var/log on some systems:

[monitor:///mnt/qa/]
whitelist = (xxx1|xxx2|xxx3)

Reference:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata

Re: Splunk Universal forwarder inputs.conf

ajaybguthi — Tue, 19 Mar 2013 19:49:09 GMT

Thanks starcher that helped me