topic Re: adding rolling.logs to splunk windows in Getting Data In

adding rolling.logs to splunk windows

brod_geico — Thu, 11 Dec 2014 19:32:46 GMT

I need to input below file to splunk

D:\Debug\Log\Forms\Rollingfile

and
D:\Debug\Log\Forms\Rollingfile.log20140228 with time stamp multipe file

i tried with below things in inputs.conf file but only Rollingfile was showing

Rollingfile.log20140228 not showing in splunk

[monitor://D:\Debug\Log\Forms\*.log*]
recursive = true
crcSalt = 
whitelist = \.log$|\.txt$|\.xml$|\.out$
sourcetype = log4net
index = int


[monitor://D:\Debug\Log\Forms\]
recursive = true
crcSalt = 
disabled = 0
followTail = 0
whitelist = \.(log$
sourcetype = log4net
index = int

Re: adding rolling.logs to splunk windows

somesoni2 — Thu, 11 Dec 2014 19:43:50 GMT

Try this

[monitor://D:\Debug\Log\Forms\Rollingfile*]
recursive = true
crcSalt = <SOURCE>
sourcetype = log4net
index = int

Re: adding rolling.logs to splunk windows

brod_geico — Thu, 11 Dec 2014 20:21:47 GMT

tried too not working

[monitor://D:\Debug\Log\Forms\Rollingfile*]
recursive = true
crcSalt =
sourcetype = log4net
index = forms_int

Re: adding rolling.logs to splunk windows

martin_mueller — Fri, 12 Dec 2014 00:04:08 GMT

Your whitelists ending in .log, .txt, etc. are conflicting with the file name ending in the date.