topic Splunk forwarder on linux: parameter format error after adding monitor in Getting Data In

Splunk forwarder on linux: parameter format error after adding monitor

thambisetty — Wed, 25 Jun 2014 09:48:38 GMT

Hi,
I have installed splunk forwarder on linux which is having symantec Brightmail Gateway.
and i tried to forward the data from that machine to splunk indexer that forwarder sending data only one file under the folder.
The path which i have given while adding the monitor:
'/var/log/mail/symantec/inbound'
under the inbound i want to read everything which has extension of type '.gz'
i am getting error that is "parameter should be in this format '-parameter value' "
while try to give the path like '/var/log/mail/symantec/inbound/*.gz'
can anyone tell me why its happening like that
please.......

Re: Splunk forwarder on linux: parameter format error after adding monitor

Ayn — Wed, 25 Jun 2014 10:04:50 GMT

If you're adding things from the CLI, you need to make sure that your shell is not expanding wildcards for you. If you do

splunk add monitor /var/log/mail/symantec/inbound/*.gz

Your shell will expand this into all files that match that. In order to prevent that from happening you need to escape it, for instance by putting it in single quotes.

splunk add monitor '/var/log/mail/symantec/inbound/*.gz'

Re: Splunk forwarder on linux: parameter format error after adding monitor

thambisetty — Thu, 26 Jun 2014 05:24:28 GMT

now i want to remove that which i added to monitor earlier.
May i konw how to do that.again i will add to monitor as u said

Re: Splunk forwarder on linux: parameter format error after adding monitor

MuS — Sun, 18 Oct 2015 19:42:20 GMT

Like the add command there is a remove command to remove monitor:

splunk remove monitor '/var/log/mail/symantec/inbound/*.gz'

cheers, MuS