topic Re: Inputs.conf Not Picking Up What I expect in Getting Data In

Inputs.conf Not Picking Up What I expect

daniel333 — Tue, 19 Nov 2013 23:37:11 GMT

I am trying to pull in a several log files that are always being updated from a folder on Windows. Here is my inputs.conf

[monitor://C:\Siebel\sba81\siebsrvr\BIN\*.log]
index=siebel
sourcetype=siebel_scg_logs

But the results in splunk only show one file ignoring all the other ones. Any idea why Splunk is not gathering the other log files in the directory? Did I miss something in the stanza I needed?

Re: Inputs.conf Not Picking Up What I expect

somesoni2 — Tue, 19 Nov 2013 23:58:04 GMT

Would it be possible for you to tell the filenames present in the folder?

Re: Inputs.conf Not Picking Up What I expect

lukejadamec — Wed, 20 Nov 2013 00:01:30 GMT

You should post your monitor string as code (select the 101010 format option at the top).
Escape characters are important in a monitor string.

Re: Inputs.conf Not Picking Up What I expect

Ayn — Wed, 20 Nov 2013 07:33:30 GMT

This script will help you in determining what status Splunk has for your monitor inputs: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/

Re: Inputs.conf Not Picking Up What I expect

pradeepkumarg — Thu, 21 Nov 2013 20:49:21 GMT

" * " doesn't work as expected in windows

This should work

[monitor://C:\Siebel\sba81\siebsrvr\BIN\]
index=siebel
sourcetype=siebel_scg_logs
whitelist=\.log$

Re: Inputs.conf Not Picking Up What I expect

lukejadamec — Thu, 21 Nov 2013 21:07:30 GMT

That is not exactly true, you just need to 'know' what to expect. If you want to get dizzy you can read the rules:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Specifyinputpathswithwildcards

My guess is that splunk is treating \* as regex not a * wildcard. Regardless, I believe the example in the doc says that \* does not work in Windows; you should expect it to fail.