topic Re: Monitoring an entire folder with yesterday flagged files in Getting Data In

Monitoring an entire folder with yesterday flagged files

royimad — Mon, 28 Sep 2020 14:10:01 GMT

Hello Splunk Experts,

I have a folder that i need to monitored entirely:
the folder contains a list that is represented by the following:

namefile1_yyyymmdd.csv
namefile2_yyyymmdd.csv
namefile3_yyyymmdd.csv

each day this folder will contains CSV's from yesterday,
How splunk could monitor automatically such folder?

Thanks,

Re: Monitoring an entire folder with yesterday flagged files

Ayn — Tue, 25 Jun 2013 07:54:38 GMT

Not sure I understand the problem - what's stopping you from simply monitoring the directory?

Re: Monitoring an entire folder with yesterday flagged files

kristian_kolb — Tue, 25 Jun 2013 07:57:32 GMT

With an ordinary [monitor:///path/to/files]. Splunk will read all the files in the directory by default.

Re: Monitoring an entire folder with yesterday flagged files

royimad — Tue, 25 Jun 2013 08:11:32 GMT

I need from splunk to monitor only files of yesterday in that folder to reduce CPU consumption. I found that i can use ignoreOlderThan =

Re: Monitoring an entire folder with yesterday flagged files

royimad — Wed, 10 Jul 2013 09:13:40 GMT

vi inputs.conf
[monitor:///home/splunk/devicescollect/AgentsReads]
disabled = false
followTail = 0
host = dcpcontroller.wavemark.net
sourcetype = AgentsReads
crcSalt=
[monitor:///home/splunk/devicescollect/DevicesReads]
disabled = false
followTail = 0
host = dcpcontroller.wavemark.net
sourcetype = DevicesReads
crcSalt=
[monitor:///home/splunk/devicescollect/DevicesInfo]
disabled = false
followTail = 0
host = dcpcontroller.wavemark.net
sourcetype = DevicesInfo
crcSalt=

The above line will tell splunk to monitor the entire directory , there are mainly 3 directories created ( folders)
-AgentsReads
-DevicesReads
-DevicesInfo