topic Re: inputs.conf wildcard not working on a windows share in Getting Data In

inputs.conf wildcard not working on a windows share

bandit — Thu, 10 Oct 2013 17:10:23 GMT

Individual file monitor is working but not with the wildcards. I've tested a similar wildcard on local disk which is working.

# working
[monitor://\\host.share.com\UploadData\support\data\_Customers\M\M123\M123\GRP-123\2013_01_16.23_00_57.191957\191957.disktool.txt]

# not working
[monitor://\\host.share.com\UploadData\support\data\_Customers\*\*\*\*\*\*.disktool.txt]

Re: inputs.conf wildcard not working on a windows share

lukejadamec — Thu, 10 Oct 2013 18:06:43 GMT

Have you tried:

[monitor://\\host.share.com\UploadData\support\data\_Customers\...disktool.txt]

Re: inputs.conf wildcard not working on a windows share

bandit — Thu, 10 Oct 2013 19:04:34 GMT

Thanks, this works for one monitor stanza but introduces another issue since I have multiple monitor stanzas. Only one works at a time but if both are enabled, only the last one works. Both stanzas below are similar but one has disktool.txt and one has diskview.txt.
[monitor://\host.share.com\UploadData\support\data_Customers...*.disktool.txt]
crcSalt =
index = eql_disktool
sourcetype = disktool

[monitor://\host.share.com\UploadData\support\data_Customers...*.diskview.txt]
crcSalt =
index = eql_diskview
sourcetype = diskview

Re: inputs.conf wildcard not working on a windows share

lukejadamec — Thu, 10 Oct 2013 22:49:04 GMT

I've been reading
http://docs.splunk.com/Documentation/Splunk/latest/Data/Specifyinputpathswithwildcards
And after a few aspirin, I've decided that the slash after the ellipse is escaping the asterisk thereby making it literal for the first one because the slash is a regex character. Unfortunately, why the last one works does not make sense, and the doc does not explain that much aspirin.

Regardless, I think that the ellipse wildcard should handle all of your wildcard needs, so I've updated the answer to remove the last \ and *.

Re: inputs.conf wildcard not working on a windows share

lukejadamec — Fri, 11 Oct 2013 00:54:38 GMT

After further experimentation I have found that this works just fine on local drives, with or without the last \ or *. Must be a problem with shares.

Re: inputs.conf wildcard not working on a windows share

bandit — Fri, 11 Oct 2013 01:33:42 GMT

I think it's just that Splunk doesn't multiple similar stanzas for monitor rules that contain wild cards. Not sure if that's a performance setting? It seems and individual rule does work on the shares. This would be quite simple to do with a linux ls script to list out multiple files with a simple pattern. Hope a future update will simplify this type of monitor. I've been reading the doc below and testing out using props.conf with a single monitor rule. Hoping not to have also use transforms. http://blogs.splunk.com/2010/02/11/sourcetypes-gone-wild/